NORTH KOREAN HACKERS TARGETING CRYPTO EXPERTS WITH KANDYKORN MACOS MALWARE

Summary from the TLDR InfoSec newsletter

North Korean state-sponsored hackers have targeted blockchain engineers of an unnamed crypto exchange platform via Discord using macOS malware named KANDYKORN. Security researchers have linked the activity, which began in April 2023, to the Lazarus Group. The attackers lured victims by impersonating blockchain engineers on a public Discord server. The malware is a full-featured memory resident RAT with built-in capabilities to enumerate files, run additional malware, exfiltrate data, terminate processes, and run arbitrary commands.