UNC5342

UNC5342 is a North Korea-linked APT that employs the EtherHiding technique to deliver malware and facilitate cryptocurrency theft. The actor has been observed deploying EtherRAT and JADESNOW malware, utilizing transaction history as a Dead Drop Resolver to embed payloads directly into the calldata of blockchain transactions. Their operations involve leveraging centralized API services to interact with public blockchains like Ethereum and BNB Smart Chain. The malware is designed to exfiltrate sensitive data, particularly targeting cryptocurrency wallets and credentials.

Grubun kökeni Kuzey Kore olarak bildiriliyor.

Bu aktör hakkında yayımlanmış raporlar:

• https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding

Kaynak: MISP Galaxy, Malpedia.