They are notable for recent thefts from the South Korean Ministry of Defense. Whilst naming conventions differ somewhat between vendors, Bluenorroff and Andariel are generally considered part of a wider set of attackers known as Lazarus:īluenorroff are best known for the partially successful theft of $951 million from the Bank of Bangladesh.Īndariel are perhaps a later evolution of BlackMine mentioned above. There are previous reports of North Korean attackers mining Monero:Ī group known as Bluenorroff mined Monero on compromised servers during an attempted theft from a bank andĪ group known as Andariel mined Monero on the network of a South Korean company they had compromised. Monero mining linked to North Korea attackers Unless all three samples are a prank by Moroccan hackers. Therefore 2) may be the more likely scenario. Software created by entirely different authors that copied code from the same location, for example a forum.īased on the compilation string, initial upload location and French text - it’s likely the author of these two other samples is from Morocco. These samples are even simpler, and may be: We identified two other pieces of software which share some code: KSU is an unusually open University, and has a number of foreign students and lecturers. If the software author is at KSU, they may not be North Korean. But it also contains fake filenames that appear to be an attempt to avoid detection of the installed mining software. On the one hand the sample contains obvious messages printed for debugging that an attacker would avoid. It’s not clear if we’re looking at an early test of an attack, or part of a ‘legitimate’ mining operation where the owners of the hardware are aware of the mining. The usage of a North Korean server is a prank to trick security researchers. The address used to resolve but no longer does or The application is designed to be run within another network, such as that of the university itself That means the software can’t send mined currency to the authors - on most networks.

The hostname address doesn’t currently resolve. The password, KJU, is a possible reference to Kim Jong-un The domain indicates this server is located at Kim Il Sung University. The installer passes xmrig the following arguments:ĤJUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS is the address of the Monero walletī is the mining server that would receive any mined currency. p KJU' + processorCount + ' -k -t ' + (processorCount -1)' The Installer executes Xmrig with the following command:

Crypto web miner