Северокорейские хакеры нацелились на соискателей криптовалютных вакансий в Индии

cryptonews.ruPublished on 2025-03-19Last updated on 2025-06-19

Компания Cisco Talos сообщила, что северокорейская хакерская группировка под названием «Famous Chollima» сосредоточила свои атаки на соискателях криптоработы в Индии. Эта группировка, по-видимому, не имеет прямого отношения к Lazarus.

На данный момент сложно определить, были ли эти действия мелкими кражами или предварительной подготовкой к более масштабным атакам. В дальнейшем соискателям в криптоиндустрии следует проявлять осторожность.

Криптохаки в Северной Корее Продолжаются

Северокорейская Lazarus Group имеет внушительную репутацию в сфере криптопреступности, совершив крупнейшую хакерскую атаку в истории отрасли. Однако это не единственное преступное предприятие в сфере Web3 в Северной Корее, поскольку она широко представлена в DeFi.

Компания Cisco Talos выявила несколько недавних случаев преступной деятельности в Индии, связанных с кражей криптовалюты:

Судя по сообщениям, Famous Chollima — это не что-то новое; она функционирует с середины 2024 года или даже раньше. В ходе нескольких недавних инцидентов северокорейские хакеры пытались проникнуть в американские криптокомпании, такие как Kraken, подавая заявки на открытые вакансии.

Знаменитая компания Chollima поступила наоборот, заманивая потенциальных работников фальшивыми заявками.

«Эти кампании включают в себя… создание поддельных объявлений о вакансиях и страниц для проверки навыков. На последних пользователям предлагается скопировать и вставить вредоносную командную строку, чтобы установить драйверы, необходимые для прохождения финального этапа проверки навыков. [Затронутые пользователи] в основном находятся в Индии», — заявили в компании.

По сравнению с грозной репутацией Lazarus, фишинговые атаки Famous Chollima кажутся гораздо более неуклюжими. В Cisco заявили, что поддельные приложения этой группы всегда имитировали известные криптофирмы.

В этих объявлениях не использовался фирменный стиль реальных компаний, а вопросы были едва ли связаны с предполагаемыми вакансиями.

Поддельное приложение Robinhood, используемое для взлома. Источник: Cisco Talos

Заглатывание наживки

Жертв заманивают на поддельные сайты по трудоустройству, выдающие себя за известные технологические или криптовалютные компании. После заполнения анкет их приглашают на видеоинтервью.

Во время этого процесса сайт предлагает им выполнить инструкции командной строки, якобы предназначенные для установки видеодрайверов, которые на самом деле загружают и устанавливают вредоносное ПО.

После установки PylangGhost предоставляет злоумышленникам полный контроль над системой жертвы. Он крадёт учётные данные для входа в систему, данные браузера и информацию о криптовалютном кошельке, нацеливаясь на более чем 80 популярных расширений, таких как MetaMask, Phantom и 1Password.

Недавно, после предотвращения атаки вредоносного ПО, BitMEX заявила, что Lazarus использует как минимум две команды: команду с низким уровнем квалификации для первоначального взлома протоколов безопасности и команду с высоким уровнем квалификации для последующих краж. Возможно, это обычная практика для хакерского сообщества Северной Кореи.

К сожалению, трудно сделать какие-либо однозначные выводы, не прибегая к домыслам. Хочет ли Северная Корея взломать этих соискателей, чтобы они лучше подходили на роль работников криптоиндустрии?

Пользователям следует с осторожностью относиться к незапрошенным предложениям о работе, избегать запуска неизвестных команд и защищать свои системы с помощью защиты конечных точек, многофакторной аутентификации и мониторинга расширений браузера.

Airwallex's Pivot: From Dismissing Stablecoins a Year Ago to Making High-Profile Investments Today

Airwallex, a major cross-border payments fintech, has made a notable strategic shift by leading a seed round investment in Metal, a tokenized financial settlement network. This move is significant given that Airwallex founder Jack Zhang was a prominent critic of stablecoins just a year prior, arguing they failed to reduce costs for mainstream currency corridors and lacked clear utility. The investment targets Metal, a Layer-1 blockchain designed for the tokenization and settlement of assets like stocks, bonds, and stablecoins, aiming for the institutional market. Metal's team includes veterans from Ren Protocol and Meta's Diem project. For Airwallex, this partnership integrates tokenized finance into its global payments network, providing a new settlement layer. Despite his company's investment, Zhang maintains a distinction, stating his skepticism toward "cryptocurrencies" remains, while classifying regulated, asset-backed stablecoins as a separate category. This stance reflects a broader trend of traditional finance (TradFi) cautiously engaging with crypto infrastructure. Companies like Stripe, Mastercard, and major banks are similarly exploring stablecoin payments and tokenization networks, recognizing their potential in emerging markets and 24/7 settlement. The article concludes that Airwallex's investment is less a change of belief and more a strategic necessity to secure a position in the evolving landscape of digital asset settlement, where stablecoins are becoming a key interface for global finance.

marsbit5m ago

Worldcoin’s breakdown may be the start of a bigger fall – Here’s why

Worldcoin (WLD) fell 10.27% to near $0.4635, with trading volume dropping 14.05%. The simultaneous decline in price and volume signaled weakening buyer participation, leaving sellers in control of the short-term direction. WLD broke below both its ascending channel structure and the psychological $0.50 level after failing to sustain an earlier advance toward $0.67 resistance. On-chain data showed Spot Taker CVD remained seller-dominant, indicating market sell orders continued to outweigh aggressive buying. Despite a drop in overall trading activity, the Spot Volume Bubble Map signaled overheating, suggesting elevated speculative activity and a continued risk of sharp price swings. Technically, the breakdown from the ascending channel was confirmed by a bearish MACD crossover, with the histogram expanding into negative territory. This shifted the outlook, with WLD now approaching the major $0.40 support level. A successful defense of $0.40 could lead to a rebound toward $0.50. However, a break below this support would expose the next major downside target near $0.23, as persistent selling pressure and a lack of buyer confidence leave the token vulnerable to further declines.

ambcrypto11m ago

Worldcoin’s breakdown may be the start of a bigger fall – Here’s why

ambcrypto11m ago

Airwallex's Pivot: From Scorning Stablecoins a Year Ago to High-Profile Capital Influx Today

Airwallex, a major cross-border fintech company, has co-led a seed investment round in Metal, a tokenized financial settlement network. This move is notable because Airwallex's founder, Jack Zhang, was a vocal critic of stablecoins just a year ago, arguing they failed to reduce costs in mainstream currency corridors and lacked clear utility. Metal is a Layer-1 blockchain designed for institutional-grade tokenized asset settlement, targeting a multi-trillion dollar market. Its team includes veterans from Ren Protocol and Meta's Diem project. For Airwallex, this investment integrates tokenized products—from stablecoins to securities—into its global payment network, blending its traditional compliance and FX capabilities with blockchain efficiency. While Zhang maintains his skepticism towards cryptocurrencies, he now distinguishes asset-backed stablecoins from them. His shift reflects a broader trend of traditional finance giants like Stripe, Mastercard, and JPMorgan strategically embracing stablecoins and tokenization for emerging markets and next-generation settlement infrastructure. For Airwallex, investing in Metal is less about a change in belief and more about securing a strategic position for the future of finance.

链捕手16m ago

The First Large-Scale Generative Model Using Physics as a Computational Primitive, Un-0, is Here: Could AI Energy Consumption Be Reduced by 1000x?

Unconventional AI has unveiled Un-0, a large-scale image generation model that uses the physical dynamics of coupled oscillators as its computational primitive. Described as the "first to use physics as a computation primitive for large-scale generative models," Un-0 aims to demonstrate a path toward dramatically reducing AI's energy consumption—potentially by up to 1000x compared to current GPU-based digital systems. The model operates by training a system of thousands of Kuramoto-like oscillators, where learned coupling strengths and natural frequencies define its behavior. Starting from random phases, the system evolves under its physical dynamics, guided by class-conditioning inputs, and a small traditional decoder then renders the final image. On ImageNet 64x64, Un-0 achieved an FID score of 6.74, performance comparable to early traditional generative models, though not yet state-of-the-art. The project, led by former Databricks AI chief Naveen Rao, represents a foundational step in using physical systems for computation, merging memory and processing in a single dynamic entity to bypass the energy-intensive data movement of von Neumann architectures.

marsbit23m ago

The First Large-Scale Generative Model Using Physics as a Computational Primitive, Un-0, is Here: Could AI Energy Consumption Be Reduced by 1000x?

marsbit23m ago

Spicy Review｜Is the "Most Emotionally Valuable" Post Here? Could STRC Be the Next LUNA?

Here is an English summary of the article (under 1500 characters): This article from the spicy commentary series "LaPing" covers three key stories in the crypto world for the week. First, during a sharp market downturn in June where BTC fell over 20%, a Reddit post on r/Cryptocurrency rallying against "Fear, Uncertainty, and Doubt (FUD)" went viral. The comment section became a hub for retail traders to share memes and encouragement, with many advocating holding (HODLing) through the volatility, embodying the "be fearful when others are greedy" mantra. Second, it examines the situation with STRG (Strategy's perpetual preferred stock), which has "de-pegged," trading around $76 vs. its $100 face value, a ~25% discount. The concern is whether Michael Saylor's company, MicroStrategy, can sustain the $1.2 billion annual dividend payment, given its ~$1.4 billion cash reserve. While analysts note STRG is fundamentally different from the catastrophic LUNA collapse—as Saylor isn't obligated to pay the dividend—risks remain. If MicroStrategy's (MSTR) common stock investors feel their capital is being prioritized for STRG dividends, it could hurt MSTR demand. Third, the article analyzes the online persona of "Chuan Mu," a trader famous for turning $500 into $1 million during the 2023 ORDI inscription boom and again with short positions in 2025. An analysis of his 1,828 tweets reveals his success stems from a top-down analytical framework, asking systemic questions like "Where will the bottleneck be in the AI supply chain?" rather than chasing individual pumps. His investments migrated from crypto-linked stocks to AI infrastructure plays like SK Hynix and Samsung. However, the piece also notes criticism that he has occasionally "pumped" assets and sold positions without notifying followers, creating a contradictory public image. The weekly recap highlights themes of community sentiment during bear markets, financial instrument risks, and the complex realities of following influential online traders.

Foresight News39m ago

Spicy Review｜Is the "Most Emotionally Valuable" Post Here? Could STRC Be the Next LUNA?