Lazarus 集团利用虚假区块链游戏利用 Google Chrome 中的零日漏洞

朝鲜拉撒路黑客组织利用基于区块链的虚假游戏利用谷歌 Chrome 浏览器中的零日漏洞并安装间谍软件

North Korean Lazarus Group hackers have exploited a zero-day vulnerability in Google Chrome to install spyware that steals wallet credentials, using a fake blockchain-based game to carry out the attack.

朝鲜 Lazarus Group 黑客利用 Google Chrome 中的零日漏洞安装间谍软件，窃取钱包凭证，并使用虚假的基于区块链的游戏来实施攻击。

The Lazarus Group’s activities were detected by Kaspersky Labs analysts in May, who reported the exploit to Google. The vulnerability has since been fixed by Google.

卡巴斯基实验室分析师于 5 月份发现了 Lazarus Group 的活动，并向 Google 报告了该漏洞。该漏洞已被谷歌修复。

Playing at a high risk

玩游戏的风险很高

The hackers’ game, which was fully playable, was promoted on LinkedIn and X. It was called DeTankZone or DeTankWar and featured tanks represented by non-fungible tokens (NFTs) that competed in a global tournament.

这款完全可玩的黑客游戏在 LinkedIn 和 X 上进行了推广。它被称为 DeTankZone 或 DeTankWar，以不可替代代币 (NFT) 为代表的坦克参加全球锦标赛。

Interestingly, users could get infected from the game’s website even without downloading the game itself. The hackers reportedly modeled the game on the existing DeFiTankLand.

有趣的是，即使用户没有下载游戏本身，也可能从游戏网站受到感染。据报道，黑客以现有的 DeFiTankLand 为模型设计了这款游戏。

According to the report, the hackers deployed Manuscrypt malware, followed by a previously unseen “type confusion bug in the V8 JavaScript engine.” This marked the seventh zero-day vulnerability found in Chrome in 2024 up to mid-May.

根据该报告，黑客部署了 Manuscrypt 恶意软件，随后出现了以前未见过的“V8 JavaScript 引擎中的类型混淆错误”。这是 2024 年截至 5 月中旬 Chrome 中发现的第七个零日漏洞。

“The fake game was noticed by Microsoft Security back in February. However, by the time Kaspersky was able to look into it, the threat actor had already removed the exploit from the website,” Boris Larin, principal security expert at Kaspersky, told Securelist.

“微软安全部门早在二月份就注意到了这款假游戏。然而，当卡巴斯基能够调查它时，威胁行为者已经从网站上删除了该漏洞，”卡巴斯基首席安全专家鲍里斯·拉林 (Boris Larin) 告诉 Securelist。

Despite this, the lab went ahead and informed Google about the exploit, and Chrome fixed the vulnerability before the hackers could reintroduce it.

尽管如此，该实验室还是继续向谷歌通报了该漏洞，Chrome 在黑客重新引入该漏洞之前修复了该漏洞。

Screenshot from Lazarus Group’s fake game, as shared by SecureList

SecureList 分享的 Lazarus Group 假游戏的屏幕截图

Related: FBI highlights 6 Bitcoin wallets linked to North Korea, urging crypto exchanges to be vigilant

相关：FBI 强调 6 个与朝鲜有关的比特币钱包，敦促加密货币交易所保持警惕

North Korea has a thing for crypto

朝鲜热衷于加密货币

Zero-day vulnerabilities are those that a vendor is made aware of for the first time, without any patch being ready for it. In this case, it took Google 12 days to patch the vulnerability in question.

零日漏洞是供应商在没有准备任何补丁的情况下首次发现的漏洞。在这种情况下，谷歌花了 12 天的时间来修复相关漏洞。

Earlier this year, another zero-day vulnerability in Chrome was exploited by a separate North Korean hacker group to target crypto holders.

今年早些时候，Chrome 中的另一个零日漏洞被一个独立的朝鲜黑客组织利用，以加密货币持有者为目标。

As reported by Microsoft Threat Intelligence, Lazarus Group is known to have a strong preference for cryptocurrency. According to crypto crime watcher ZachXBT, the group laundered over $200 million in crypto from 25 hacks between 2020 and 2023.

据 Microsoft Threat Intelligence 报道，众所周知，Lazarus Group 对加密货币有着强烈的偏好。据加密货币犯罪观察者 ZachXBT 称，该组织在 2020 年至 2023 年间通过 25 次黑客攻击洗掉了超过 2 亿美元的加密货币。

The United States Treasury Department has also accused Lazarus Group of being behind the 2022 attack on Ronin Bridge, which resulted in the theft of crypto valued at over $600 million.

美国财政部还指控 Lazarus Group 是 2022 年 Ronin Bridge 袭击事件的幕后黑手，该事件导致价值超过 6 亿美元的加密货币被盗。

Over the seven-year period from 2017 to 2023, North Korean hackers stole a total of more than $3 billion in crypto, according to cybersecurity firm Recorded Future.

根据网络安全公司 Recorded Future 的数据，从 2017 年到 2023 年的七年时间里，朝鲜黑客总共窃取了超过 30 亿美元的加密货币。

Magazine: Lazarus Group’s favorite exploit revealed — An analysis of crypto hacks by the notorious group

杂志：Lazarus Group 最喜欢的漏洞被揭露——该臭名昭著的组织对加密货币黑客的分析