25/10/2024 Lazarus Group exploited Chrome vulnerability with fake NFT game

The North Koreans invested great effort in creating and promoting a game that apparently drained users’ wallets.

Lazarus Group exploited Chrome vulnerability with fake NFT game

The North Koreans invested great effort in creating and promoting a game that apparently drained users’ wallets.

The North Korean Lazarus Group of hackers used a fake blockchain-based game to exploit a zero-day vulnerability in Google’s Chrome browser and install spyware that stole wallet credentials. Kaspersky Labs analysts noticed the exploit in May and reported it to Google, which has fixed it.

McDonald’s Collaboration Sparks Doodles NFT Floor Price Surge
NFTs weekly sales surge 94% as crypto market continues bullish run
NFT Marvel Marketplace Launches On Binance

Play at a big risk

The hacker’s play-to-earn multiplayer online battle arena game was fully playable and had been promoted on LinkedIn and X. The game was called DeTankZone or DeTankWar and used non-fungible tokens (NFTs) as tanks in a worldwide competition.

Users were infected from the website, even if they did not download the game. The hackers modeled the game on the existing DeFiTankLand.

The hackersusedmalware called Manuscrypt followed by a previously unknown “type confusion bug in the V8 JavaScript engine.” It was the seventh zero-day vulnerability found in Chrome in 2024 through mid-May.

Kaspersky principal security expert Boris Larin said:

“The significant effort invested in this campaign suggests they had ambitious plans, and the actual impact could be much broader, potentially affecting users and businesses worldwide.”

The fake game wasnoticedby Microsoft Security in February, though the hackers removed the exploit from the website before Kaspersky could analyze it. The lab informed Google of it anyway and Google fixed the vulnerability in Chrome before the hackers could use it again.

Screenshot from Lazarus Group’s fake game. Source:SecureList

North Korea loves crypto

Zero-day vulnerabilities take the vendor by surprise and there is no ready patch for them. It took Google 12 days to patch the vulnerability in question.

Another North Korean hacker group harnessed a different zero-day vulnerability in Chrome to target crypto holders earlier this year.

Source:Microsoft Threat Intelligence

Lazarus Group is fond of crypto. Between 2020 and 2023, itlaundered over $200 millionin crypto from 25 hacks, according to crypto crime watcher ZachXBT.

The United States Treasury Department also alleged Lazarus Groupto be behind the attack onRonin Bridge that netted crypto worth over $600 million in 2022.

US cybersecurity firm Recorded Future found that North Korean hackers as a wholestole over $3 billion in crypto between 2017 and 2023.

Arts

https://cointelegraph.com/news/north-korean-lazarus-group-chrome-zero-day-nft-game-hack

Interesting NFTs
The Harvest
An anthropomorphic figure stands, wide eyed, staring at the viewer; its body masculine, muscular, and humanoid. Its “mind” dissociates into a conglomerate of structures resembling feathers, grain, teeth–as well as a radial flower “node”, casting linear rays throughout the composition. To his left, a vat of bodies gesture and writhe in a kind of amniotic soup, attended by a video game robot. The bot's red display reads “uWu”. Behind the robot and filling the left side of the composition is an archaic figure composed of a variety of vintage objects and symbols. Among them are a hardbound book with ancient cuneiform scripts, indicating barley, beer, bread, ox, house, and sky, behind which is a grimacing, salivating jagged toothed maw; and an old Commodore floppy drive. The figure’s head tilts toward an illuminated crescent moon, suggesting the Egyptian Sacred Bull. The archaic figure is composed of a variety of mutating cells, which shift in color, and pattern; eventually breaking free into an ephemeral broadcast of bubbles which move across the background. The work came into being against a psychological introspection, which included associations to pop culture such as alien abduction and pod people, as well as quite a bit of reflection on grains as a symbol of civilization, agriculture, sustenance, life, and imbibing (mainly whiskies).
Pixel Story
This happy-go-lucky tribe made of lovable pixel Kitties have so much to talk about. While their language skills are simplistic, each Kitty still manages to express themselves with a variety of colorful emoticons and poses. From communicating their basic emotions, to discussing the economic implications of rising Ethereum gas prices, Pixel Tribe Kitties will keep each other entertained for hours. As their communications evolve and become more sophisticated, the inhabitants will come to realize that certain combinations of emotes will unlock secrets within their world. Try it out for yourself, if you're lucky enough to adopt a Kitty. Use the coordinate guide at: https://share.getcloudapp.com/7KumW6Lk to position your kitty Layer.
The Scion
A young figure caught in a moment of distraction, aware only ephemerally of his unconscious being, as it engages in psychological and psychedelic layer spaces. His right arm casually cradles a moray eel; the figure is comfortable but not truly aware of the potentials for danger in such negligence. His shirt reads “Bello” in Pokemon style font, harkening back to a childhood straddling the millennial threshold. To his right side, out of the unconscious deep, shrouded alien heads propagate as a fractal totem, each new iteration a more sophisticated rendering of emotional masking over the cold mystery of the greys. As the scion of the Budgie-Sattva, the young man, in his distraction, is also simultaneously aware of higher levels of self discovery. To his left a psychological topology sets beneath the oracle side of an 8 ball ,hovering; its message a purest concept of acceptance. The “Scion” lettering is in 80’s HeMan style bold declaration. The lower right side of the painting is like a hybrid of melon, feathers, and seeds. The crystals in the background bring light; conducted, refracted, reflected, and dispersed, to balance the dark shadow of the figure’s physical body. The aura of the scion succeeds in layers to point, with a finger, and the crown chakra, toward a center of a mandala existing as nigh pure application of strokes, in essence painterly abstraction, but also revealing hints of the Aura of migraine, and the bi-hemispherical nature of the brain–noting concerns of the possibility of inherited mental disease. Yet the flourish of chakra as it sets against that center is robust, active, coherent, and reveling against all fear. Fundamentally, the piece speaks to the activation of one’s potential to begin to “Know Thyself”, and find greater awareness out of the enigmas of the mind–as an inculcated seed given to the rich soil of one’s own birthright.
ℤ
Things are not always as they seem. Living in poverty is like serving a sentence in a prison with invisible bars. The keys are in plain sight, yet impossible to reach. Screen time captivates us with its addictive dopamine triggers, plucking at our attention span until we are no longer aware of the present... What if both worlds collide? Hand-rendered acrylics on bristol board scanned and converted into a digital image.
Luckyelder
A character from The Beacon