North Korea's infamous hacking group, Kimsuky (also known as APT43), has been serving up a side of cybercrime with a new malware dish called "Durian." This previously unknown Golang-based malware, discovered by cybersecurity giant Kaspersky, offers a comprehensive backdoor experience for the attackers. Imagine a buffet of malicious functionality: executing commands, downloading additional malware, and stealing files – all you can exploit for Kimsuky's nefarious purposes.

The attacks, targeting two unsuspecting South Korean cryptocurrency firms, unfolded between August and November 2023. Kimsuky gained initial access by exploiting a South Korean software vulnerability, essentially picking the lock before the feast began.

Once inside, Durian unleashed its full menu. It deployed Kimsuky's favorite backdoor tool, AppleSeed, for continued access. But the real intrigue lies in another course: a custom proxy tool named LazyLoad. This tool has been linked to Andariel, a subgroup within the notorious Lazarus hacking group. This connection hints at a potential shared kitchen – are these North Korean cybercriminals collaborating or simply borrowing recipes?

Kimsuky's history is a long and unsavory one. Reports suggest they've been operating since at least 2012, likely under the umbrella of North Korea's military intelligence agency, the Reconnaissance General Bureau (RGB). Phishing for crypto has been their specialty, with the group even impersonating South Korean government officials and journalists in a December 2023 scheme. Over 1,400 victims fell for their deceptive emails between March and October 2023, including retired government officials. Kimsuky isn't picky about their targets – even Russian aerospace and defense companies weren't safe during the COVID-19 pandemic.

This latest attack with Durian is a stark reminder that cryptocurrency firms are a prime target for state-backed cybercriminals. With their focus on stealing valuable digital assets, Kimsuky and other groups pose a significant threat to the financial security of the cryptocurrency industry.