According to <a href="https://www.cryptoknowmics.com/news/microsoft-supports-wemade-in-campaign-for-web3-technology">Microsoft</a>, a threat actor has been discovered that targets <a href="https://www.cryptoknowmics.com/news/us-consumer-group-investigates-crypto-firms-for-misleading-ads">crypto</a> investment businesses. In order to remotely access computers, a group that Microsoft has <a href="https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/">identified</a> as DEV-0139, pretended to be a cryptocurrency investment firm on <a href="https://www.cryptoknowmics.com/news/telegram-ceo-durov-plans-to-build-crypto-wallets-and-dex">Telegram</a> and used an Excel sheet armed with well-crafted software.
<h2>Microsoft DEV-0139 Tackles Crypto Market</h2>
The danger is a product of a pattern of sophisticated attacks. According to a blog post by Microsoft on December 6, the threat actor in this instance joined Telegram channels used to enable contact between VIP clients and cryptocurrency exchange networks while falsely posing as <a href="https://www.cryptoknowmics.com/news/binance-okx-and-bybit-halt-usdt-and-usdc-deposits-on-solana">OKX</a> staff.

The target was requested to join a new organization in October, after which they were allowed to comment on an Excel document that contrasted the VIP payment systems for OKX, <a href="https://www.cryptoknowmics.com/news/binance-custody-to-safekeep-wemades-wemix-cryptocurrency">Binance</a>, and <a href="https://www.cryptoknowmics.com/news/huobi-announces-strategic-partnership-with-poloniex">Huobi</a>. The paper delivered precise details and a high level of understanding of the realities of cryptocurrency trading. However, it also covertly sideloaded a malicious.dll (Dynamic Link Library) file to open a gateway into the user's PC. After that, during the negotiation of fees, the target was requested to open the.dll file by themselves.
<h2>Use of AppleJeus and MSI</h2>
According to Microsoft, the malicious attacker was the same as the one discovered in June using.dll files for related reasons and was likely responsible for other cases. When employing the AppleJeus malware version and an MSI (Microsoft installer), DEV-0139 is the same actor that the cybersecurity company Volexity linked to North Korea's state-sponsored Lazarus Group.

Microsoft DEV-0139 Tackles Cryptocurrency Market with Precision

Microsoft has identified as DEV-0139 pretended to be a cryptocurrency investment firm on Telegram and used an Excel sheet armed with well-crafted software.

Gungun is an enthusiastic writer that likes to create content for various aspects of the blockchain and crypto industry. She carries out extensive research and provides readers with informative and high-quality material.

Microsoft DEV-0139 Tackles Cryptocurrency Market with Precision

Top Picks