Lazarus targets blockchain firms with TraderTraitor malware

20 June 2025 routine threat financial-servicestechnology

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

North Korean Lazarus Group deploys trojanized cryptocurrency apps to steal blockchain assets and deploy remote access trojans.

Since at least 2020, the North Korean state-sponsored Lazarus Group (also tracked as APT38, BlueNoroff, Stardust Chollima) has conducted a sustained campaign targeting cryptocurrency exchanges, DeFi protocols, play-to-earn gaming companies, trading firms, venture capital funds, and individual holders of large cryptocurrency amounts or NFTs. The group uses spearphishing campaigns impersonating recruitment efforts to social-engineer employees—particularly those in system administration or DevOps roles—across multiple communication platforms into downloading malicious applications.

The primary delivery mechanism is a series of Electron-based applications written in Node.js that masquerade as legitimate cryptocurrency trading, portfolio management, or price prediction tools. Examples include DAFOM, TokenAIS, CryptAIS, AlticGO, Esilet, and CreAI Deck. Each contains a hidden UpdateCheckSync() function that downloads and executes encrypted payloads from attacker-controlled servers. Recent variants use AES-256 encryption in CBC or CTR mode to obfuscate the payload. Post-compromise activity involves deployment of Manuscrypt, a custom Windows and macOS RAT that collects system information, executes arbitrary commands, and downloads additional payloads. Intrusions typically progress to credential theft and private key exfiltration within a week of initial compromise, enabling fraudulent blockchain transactions and asset theft.

The advisory provides extensive indicators including malicious domains, file hashes (MD5, SHA-1, SHA-256), IP addresses, and C2 endpoints. Several compromised legitimate websites are used as relay hosts for command and control.

Mentioned in this report

Threat actors Lazarus Group

Malware ManuscryptTraderTraitor

Detection guidance

Node.js Process Spawning Shell With Download or Encoded Command

ATT&CK T1105

node.exe spawning cmd/PowerShell that downloads or decodes content, consistent with trojanised Electron/Node.js apps (TraderTraitor-style) fetching and running encrypted payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Process Spawning Shell With Download or Encoded Command
description: Detects node.exe (including Electron-hosted Node apps) spawning cmd.exe
  or PowerShell with download or encoded-command arguments. Trojanised crypto-trading
  Electron apps (TraderTraitor) fetch and execute encrypted payloads this way via
  a hidden update-check function.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \node.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - curl
    - Invoke-WebRequest
    - DownloadFile
    - DownloadString
    - certutil
    - bitsadmin
    - -EncodedCommand
    - FromBase64String
  filter_dev:
    CommandLine|contains:
    - npm install
    - npm.cmd
    - yarn
  condition: selection_parent and selection_child and selection_cmd and not filter_dev
falsepositives:
- Developer build or setup scripts run through node that call curl to fetch dependencies
- Node-based installers that download components via PowerShell
level: medium
id: 761549d9-5369-5867-bd0f-895ee7c8bb0e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a

macOS Application Bundle Spawning Shell Piping Curl Download to Execution

ATT&CK T1105

A macOS .app (e.g. Electron app) spawning a shell that downloads with curl and executes or drops to a temp path, matching trojanised trading apps delivering the Manuscrypt macOS payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Application Bundle Spawning Shell Piping Curl Download to Execution
description: Detects a macOS application bundle process spawning a shell that uses
  curl to download content and then executes it or writes it to a temp location. Matches
  trojanised Electron trading apps that fetch a second-stage payload (Manuscrypt macOS
  variant).
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains: .app/Contents/
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /zsh
  selection_cmd:
    CommandLine|contains|all:
    - curl
    CommandLine|contains:
    - '| sh'
    - '| bash'
    - '| zsh'
    - /tmp/
    - /var/tmp/
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Electron-based developer tools such as code editors running user-initiated install
  scripts
- Application self-updaters that download packages to /tmp
level: medium
id: 30f57f31-2596-539b-8caf-37f0cd9c8fac
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a

4 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs