State-sponsored hackers believed to be from North Korea have attempted to infect the systems of blockchain engineers with a new macOS malware. Security researchers from Elastic discovered the attempts to spread the malware, named Kandykorn, began on Discord. Impersonating blockchain community members, the hackers directed victims to download a ZIP file containing the malware, under the guise of a cryptocurrency bot. Kandykorn has capabilities to monitor, interact and avoid detection. It runs on command-and-control servers used by the Lazarus Group.
LockBit ransomware group falls victim to hackers itself
A data leak has disclosed information about negotiations with victims, Bitcoin wallet addresses, affiliate accounts, and details of attacks.
