# Lazarus targets blockchain firms with TraderTraitor malware

Published: 2025-06-20 · Severity: routine · Sectors: financial-services, technology
Canonical: https://vorant.io/reports/8498e66a-659c-58d5-a415-7ec0e48e6562/lazarus-targets-blockchain-firms-with-tradertraitor-malware

> North Korean Lazarus Group deploys trojanized cryptocurrency apps to steal blockchain assets and deploy remote access trojans.

Since at least 2020, the North Korean state-sponsored Lazarus Group (also tracked as APT38, BlueNoroff, Stardust Chollima) has conducted a sustained campaign targeting cryptocurrency exchanges, DeFi protocols, play-to-earn gaming companies, trading firms, venture capital funds, and individual holders of large cryptocurrency amounts or NFTs. The group uses spearphishing campaigns impersonating recruitment efforts to social-engineer employees—particularly those in system administration or DevOps roles—across multiple communication platforms into downloading malicious applications.

The primary delivery mechanism is a series of Electron-based applications written in Node.js that masquerade as legitimate cryptocurrency trading, portfolio management, or price prediction tools. Examples include DAFOM, TokenAIS, CryptAIS, AlticGO, Esilet, and CreAI Deck. Each contains a hidden UpdateCheckSync() function that downloads and executes encrypted payloads from attacker-controlled servers. Recent variants use AES-256 encryption in CBC or CTR mode to obfuscate the payload. Post-compromise activity involves deployment of Manuscrypt, a custom Windows and macOS RAT that collects system information, executes arbitrary commands, and downloads additional payloads. Intrusions typically progress to credential theft and private key exfiltration within a week of initial compromise, enabling fraudulent blockchain transactions and asset theft.

The advisory provides extensive indicators including malicious domains, file hashes (MD5, SHA-1, SHA-256), IP addresses, and C2 endpoints. Several compromised legitimate websites are used as relay hosts for command and control.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: Manuscrypt, TraderTraitor

## Detection guidance (public sample)

### Node.js Process Spawning Shell With Download or Encoded Command

ATT&CK: T1105

node.exe spawning cmd/PowerShell that downloads or decodes content, consistent with trojanised Electron/Node.js apps (TraderTraitor-style) fetching and running encrypted payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js Process Spawning Shell With Download or Encoded Command
description: Detects node.exe (including Electron-hosted Node apps) spawning cmd.exe
  or PowerShell with download or encoded-command arguments. Trojanised crypto-trading
  Electron apps (TraderTraitor) fetch and execute encrypted payloads this way via
  a hidden update-check function.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \node.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - curl
    - Invoke-WebRequest
    - DownloadFile
    - DownloadString
    - certutil
    - bitsadmin
    - -EncodedCommand
    - FromBase64String
  filter_dev:
    CommandLine|contains:
    - npm install
    - npm.cmd
    - yarn
  condition: selection_parent and selection_child and selection_cmd and not filter_dev
falsepositives:
- Developer build or setup scripts run through node that call curl to fetch dependencies
- Node-based installers that download components via PowerShell
level: medium
id: 761549d9-5369-5867-bd0f-895ee7c8bb0e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a
```

### macOS Application Bundle Spawning Shell Piping Curl Download to Execution

ATT&CK: T1105

A macOS .app (e.g. Electron app) spawning a shell that downloads with curl and executes or drops to a temp path, matching trojanised trading apps delivering the Manuscrypt macOS payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS Application Bundle Spawning Shell Piping Curl Download to Execution
description: Detects a macOS application bundle process spawning a shell that uses
  curl to download content and then executes it or writes it to a temp location. Matches
  trojanised Electron trading apps that fetch a second-stage payload (Manuscrypt macOS
  variant).
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains: .app/Contents/
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /zsh
  selection_cmd:
    CommandLine|contains|all:
    - curl
    CommandLine|contains:
    - '| sh'
    - '| bash'
    - '| zsh'
    - /tmp/
    - /var/tmp/
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Electron-based developer tools such as code editors running user-initiated install
  scripts
- Application self-updaters that download packages to /tmp
level: medium
id: 30f57f31-2596-539b-8caf-37f0cd9c8fac
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

4 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8498e66a-659c-58d5-a415-7ec0e48e6562/lazarus-targets-blockchain-firms-with-tradertraitor-malware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup