Spear Phishing Fake Job Offer Likely Behind Axie Infinity’s Lazarus $600m Hack

A fake LinkedIn job offer was the reason behind Axie Infinity’s $ 600m hack, according to a new investigation by The Block.

The digital assets-focused outlet said on Wednesday that while the US government attributed the attack to the North Korean hacker group Lazarus, full details of how the exploit was executed had not been disclosed.

The Block said that according to two unnamed people with direct knowledge of the matter, a senior engineer at Axie Infinity named Sky Mavis was tricked into applying for a job at a non-existent company.

Mavis would have been approached by people via LinkedIn encouraging her to apply for the job, and after passing multiple interviews, she was offered a job with “an extremely generous compensation package.”

The message with the fake offer, however, contained a PDF that, once opened, would have delivered spyware that infected Ronin, the Ethereum-linked sidechain upon which Axie Infinity was based.

The malware would then have enabled hackers to attack and take over four out of nine validators on the Ronin network.

“This is a perfect example of the risks of file-based threats and how easy it is for hackers to infiltrate your systems through documents shared both externally and internally,” Glasswall CEO Danny Lopez told Infosecurity Magazine.

“You can never be too careful – no matter how legitimate something looks on the surface, it can harbor malicious code,” Lopez added.

According to the security expert, taking a proactive approach to cybersecurity is far more efficient and cost-effective than relying on a reactive approach.

“Content Disarm and Reconstruction (CDR) technology is an example of a proactive approach that provides immediate protection as a threat enters the IT environment,” Lopez explained.

“All files undergo an instant, four-step process to ensure that every document is completely safe by removing any potentially malicious code.”

Lopez called CDR a simple, proactive solution and said it is particularly valuable because it helps create a digital environment where a threat cannot exist.

“This means that users can trust every document that enters or leaves an organization. What’s more, CDR achieves this quickly, allowing operations to continue as usual without sacrificing productivity or security. ”

The Sky Mavis news comes weeks after the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned cryptocurrency mixing service Blender.io after it was allegedly used by North Korean hackers in the Ronin hack.

Source

A fake LinkedIn job offer was the reason behind Axie Infinity’s $ 600m hack, according to a new investigation by The Block.

The digital assets-focused outlet said on Wednesday that while the US government attributed the attack to the North Korean hacker group Lazarus, full details of how the exploit was executed had not been disclosed.

The Block said that according to two unnamed people with direct knowledge of the matter, a senior engineer at Axie Infinity named Sky Mavis was tricked into applying for a job at a non-existent company.

Mavis would have been approached by people via LinkedIn encouraging her to apply for the job, and after passing multiple interviews, she was offered a job with “an extremely generous compensation package.”

The message with the fake offer, however, contained a PDF that, once opened, would have delivered spyware that infected Ronin, the Ethereum-linked sidechain upon which Axie Infinity was based.

The malware would then have enabled hackers to attack and take over four out of nine validators on the Ronin network.

“This is a perfect example of the risks of file-based threats and how easy it is for hackers to infiltrate your systems through documents shared both externally and internally,” Glasswall CEO Danny Lopez told Infosecurity Magazine.

“You can never be too careful – no matter how legitimate something looks on the surface, it can harbor malicious code,” Lopez added.

According to the security expert, taking a proactive approach to cybersecurity is far more efficient and cost-effective than relying on a reactive approach.

“Content Disarm and Reconstruction (CDR) technology is an example of a proactive approach that provides immediate protection as a threat enters the IT environment,” Lopez explained.

“All files undergo an instant, four-step process to ensure that every document is completely safe by removing any potentially malicious code.”

Lopez called CDR a simple, proactive solution and said it is particularly valuable because it helps create a digital environment where a threat cannot exist.

“This means that users can trust every document that enters or leaves an organization. What’s more, CDR achieves this quickly, allowing operations to continue as usual without sacrificing productivity or security. ”

The Sky Mavis news comes weeks after the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned cryptocurrency mixing service Blender.io after it was allegedly used by North Korean hackers in the Ronin hack.

Source

More from author

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Related posts

Advertismentspot_img

Latest posts

Multiple Vulnerabilities Discovered in Device42 Asset Management Appliance

A series of vulnerabilities on the popular asset management platform Device42 could be exploited to give attackers full root access to the system, according...

Top 5 best backup practices

Give yourself peace of mind by implementing a new backup strategy with our tips....

Indian Power Sector targeted with latest LockBit 3.0 variant

Estimated reading time: 5 minutesAfter the infamous Conti ransomware group was disbanded, its former members began to target the energy and power sectors...

Want to stay up to date with the latest news?

We would love to hear from you! Please fill in your details and we will stay in touch. It's that simple!