- Citrine Sleet and its methods
- The hacker and Chromium vulnerability
- Microsoft's precautionary measures
Tech giant Microsoft recently warned about a North Korean threat actor exploiting a zero-day vulnerability in Google’s Chromium to gain remote code execution to steal crypto assets from unsuspecting users.
Citrine Sleet and its methods
Tracked by Microsoft as Citrine Sleet, the threat actor is believed to have conducted extensive reconnaissance of the crypto industry and specializes in targeting institutions or individuals managing digital assets using the unique trojan malware it developed, AppleJeus. Other security firms track the threat actor as Hidden Cobra, Labyrinth Chollima, UNC4736, and AppleJeus.
The hacker and Chromium vulnerability
In a recent blog post, Microsoft said Citrine Sleet often leverages social engineering tactics to trick users into downloading malicious software, which gathers information necessary to seize control of the target’s digital assets.
"The threat actor creates fake websites masquerading as legitimate cryptocurrency trading platforms and uses them to distribute fake job applications or lure targets into downloading a weaponized cryptocurrency wallet or trading application based on legitimate applications." The post read.
Microsoft's precautionary measures
Microsoft tied Citrine Sleet to a zero-day vulnerability hack in Chromium on August 19 after observing a malicious rootkit attributed to Diamond Sleet deployed by the threat actor. Diamond Sleet is another North Korean actor believed to be sharing hacking tools and infrastructure with Citrine Sleet.
Per the post, Google patched the vulnerability on August 21 and urged users to implement the fixes as soon as possible. Microsoft said it directly notified targeted or compromised customers and provided them with critical information to secure their environments.
Microsoft continues to enhance security measures and inform users about new threats to prevent further attacks on digital assets.
