Microsoft Flags North Korean Hacker Crypto Users Chromium

Microsoft exposes a North Korean hacker exploiting a vulnerability in Chromium to target unsuspecting crypto users.

• Microsoft has warned about a North Korean hacker targeting crypto users.
• The hacker exploited a vulnerability in Chromium.
• The actor leverages unique trojan malware to seize control of users’ digital assets.

Tech giant Microsoft recently warned about a North Korean threat actor exploiting a zero-day vulnerability in Google’s Chromium to gain remote code execution to steal crypto assets from unsuspecting users.

Tracked by Microsoft as Citrine Sleet, the threat actor is believed to have conducted “extensive reconnaissance” of the crypto industry and specializes in targeting institutions or individuals managing digital assets using the unique trojan malware it developed, AppleJeus. Other security firms track the threat actor as Hidden Cobra, Labyrinth Chollima, UNC4736, and AppleJeus.

The Citrine Sleet Threat Actor

In a recent blog post, Microsoft said Citrine Sleet often leverages social engineering tactics to trick users into downloading malicious software, which gathers information necessary to seize control of the target’s digital assets.

“The threat actor creates fake websites masquerading as legitimate cryptocurrency trading platforms and uses them to distribute fake job applications or lure targets into downloading a weaponized cryptocurrency wallet or trading application based on legitimate applications.” The post read.

Microsoft tied Citrine Sleet to a zero-day vulnerability hack in Chromium on August 19 after observing a malicious rootkit attributed to Diamond Sleet deployed by the threat actor. 

Diamond Sleet is another North Korean actor believed to be sharing hacking tools and infrastructure with Citrine Sleet.

Per the post, Google patched the vulnerability on August 21 and urged users to implement the fixes “as soon as possible.” Microsoft said it directly notified targeted or compromised customers and provided them with critical information to “secure their environments.”