BitMEX Developers Uncover Details About Lazarus Group Hackers After Accessing Their Database
BitMEX has launched a comprehensive post on its blog site describing the many exploits of North Korea’s Lazarus Group associated with recent attacks against its crypto exchange. Lazarus Group has been infamous for targeting the crypto sector, using various techniques to steal funds from unsuspecting crypto holders. The hackers have targeted exchanges like Phemex and Bybit and even approached a BitMEX employee with a phishing attempt disguised as a fake project. BitMEX is now investigating the malicious code used by the hacking group and has discovered vulnerabilities that exchanges can leverage to protect their assets. By uncovering the group’s tracking databases and origin IP addresses, BitMEX can track operational hours and isolate key actors within the group.
BitMEX has identified different tiers of hackers, ranging from amateurs assigned to phishing tasks to highly skilled individuals handling post-exploitation procedures. The blog post outlines procedures for real-time detection of security breaches, including an internal tracking system to identify infections. The sudden interest in cybersecurity was sparked when a Lazarus Group member contacted a BitMEX employee on LinkedIn with a fake NFT project proposal. BitMEX seized the opportunity to analyze live Lazarus code shared via GitHub, revealing the group’s operational details and potential security lapses.
BitMEX researchers uncovered a Lazarus Supabase containing data on malware, including user details, geolocation, and IP addresses. By categorizing devices based on operational patterns, BitMEX identified potential vulnerabilities, such as leaked IP addresses. The team also observed a structured schedule of hacker activity, indicating an organized approach to their operations.
Dealing with obfuscated code, BitMEX developers utilized JavaScript deobfuscation techniques to uncover malware details. Tools like Webcrack were employed to rename variables for better readability, facilitating the analysis of the malicious code. By understanding the hierarchy and technical capabilities of hackers, BitMEX aims to enhance its security measures and detect operational errors made by less experienced individuals.
