The BlueNoroff advanced persistent threat (APT) group, a financially-motivated division of the larger Lazarus entity, has been identified deploying sophisticated campaigns targeting the cryptocurrency industry. Using advanced social engineering, the group executes two primary operations, named ‘GhostHire’ and ‘GhostCall’, to infiltrate cryptocurrency startups, venture capital firms, and banks with the ultimate goal of stealing digital assets.

The GhostHire Deception: A Phantom Job Offer

Under the campaign name ‘GhostHire’, BlueNoroff operators create elaborate fake profiles on professional networking sites like LinkedIn. They impersonate human resources personnel from legitimate venture capital firms, such as Fenbushi Capital, to initiate contact with employees at targeted crypto startups. The attackers engage victims in a multi-stage hiring process, which can include online interviews and technical assignments, to establish credibility over time. The final stage involves sending the target a file, often disguised as a skill assessment or contract, which contains a malicious payload. This payload installs a backdoor, giving BlueNoroff persistent access to the victim’s machine and, consequently, their employer’s network.

GhostCall: The Bait of Venture Capital

In a parallel campaign dubbed ‘GhostCall’, the threat actor uses a different lure but with the same objective. Attackers pose as representatives from venture capital companies, contacting crypto startups with offers of funding or collaboration. The infection begins with an email containing a link to a password-protected document hosted on a legitimate cloud service, with the password provided in the email body. Upon opening the document and entering the password, a malicious script is executed, initiating a multi-stage infection chain. This process ultimately results in the deployment of a .NET-based backdoor, allowing the attackers to control the compromised system. BlueNoroff’s tactics involve using legitimate services like GitHub to host malware and employing a variety of file types, including LNK files and compiled HTML help files (.chm), to evade detection.