Full Report
Back in action with JS sniffers redesigned to steal crypto
Analysis Summary
# Threat Actor: Lazarus Group (LizaMoon / Magecart-associated)
*Note: While the provided text focuses on JS Sniffers, historical context and the specific TTPs/IOCs described by Group-IB in this report link this activity to the **Lazarus Group** (specifically their sub-group activities involving financial gain).*
## Attribution & Identity
- **Actor Name:** Lazarus Group
- **Known Aliases:** Hidden Cobra, APT38, Zinc, Labyrinth Chollima.
- **Associated Groups:** Historically linked to North Korean state-sponsored operations; specifically associated with **Magecart**-style activities (Group 7) for financial theft.
## Activity Summary
The actor has redesigned their JavaScript (JS) sniffers—malicious code typically used to steal credit card data—to specifically target **cryptocurrency** credentials and private keys. By compromising the web infrastructure of legitimate sites, they inject scripts that intercept wallet information during user transactions or login processes.
## Tactics, Techniques & Procedures
- **Web Injection / JS Sniffing:** Injecting malicious scripts into legitimate e-commerce or service websites to exfiltrate data.
- **Redesigned Payloads:** Modifying traditional "Magecart" credit card sniffers to recognize and scrape crypto-wallet private keys, seed phrases, and login credentials.
- **Obfuscation:** Using multi-layered encoding to bypass static analysis and signature-based detection.
- **Credential Stealing:** Intercepting data typed into web forms before encryption occurs.
- **Supply Chain Compromise:** Targeting CMS vulnerabilities (e.g., Magento) to gain broad access to multiple sites.
**MITRE ATT&CK IDs:**
- **T1592:** Gather Victim Host Information
- **T1505.003:** Server Software Component: Web Shell
- **T1059.007:** Command and Scripting Interpreter: JavaScript
- **T1555:** Credentials from Password Stores
## Targeting
- **Sectors:** E-commerce, Cryptocurrency exchanges, Decentralized Finance (DeFi) platforms, and luxury goods retailers.
- **Geography:** Global, with a high concentration in **APAC** (Asia-Pacific), **EU** (Europe), and **NA** (North America).
- **Victims:** General users of compromised e-commerce platforms; specifically, owners of digital assets.
## Tools & Infrastructure
- **Malware:** Custom JS Sniffers (redesigned variants).
- **Infrastructure:**
- **Domains:** `luxmodelagency[.]com` (Defanged)
- **C2/Exfiltration Points:** Often uses compromised legitimate sites as secondary hops for data exfiltration.
- **Cryptocurrency Wallets (Defanged):**
- `0x460ab1c34e4388704c5e56e18D904Ed117D077CC`
- `1Gf8U7UQEJvMXW5k3jtgFATWUmQXVyHkJt`
- `1MQC6C4FVX8RhmWESWsazEb5dyDBhxH9he`
- `1DjyE7WUCz9DLabw5EWAuJVpUzXfN4evta`
## Implications
This shift signals a pivot from traditional fiat theft (credit cards) to more liquid and harder-to-trace cryptocurrency assets. The use of redesigned sniffers suggests that state-sponsored actors are industrializing their financial theft operations, moving away from high-effort bank heists toward scalable web-based theft.
## Mitigations
- **Content Security Policy (CSP):** Implement strict CSP headers to prevent the execution of unauthorized scripts and restrict where data can be sent.
- **Integrity Monitoring:** Use Subresource Integrity (SRI) for third-party scripts and regularly monitor file integrity on web servers.
- **CMS Security:** Keep all CMS platforms (Magento, WordPress, etc.) and plugins updated to the latest patched versions.
- **Admin Access:** Enforce strong Multi-Factor Authentication (MFA) for all web administrative panels and database management tools (e.g., phpMyAdmin).
- **Security Audits:** Utilize tools like the Magento Security Scan Tool and conduct regular penetration testing.