Threat Intel
DPRK Lazarus‑style Attack Targets macOS Blockchain Engineers via Discord‑Delivered Python Bot
North Korean actors leveraged a disguised Python arbitrage bot sent through a public Discord channel to compromise macOS systems of blockchain engineers. The multi‑stage malware, KANDYKORN, performs in‑memory binary loading and uses several evasion techniques. Defenders should block the ZIP, monitor for Watcher.py execution, and harden Discord access.
What Happened
Security researchers uncovered a North Korean intrusion set, linked to the Lazarus Group, that targeted macOS users in the blockchain engineering community. The attackers distributed a ZIP file titled Cross‑Platform Bridges.zip via a public Discord server. Inside, a Python script named Main.py appeared to be a legitimate arbitrage bot, but it launched a chain of malicious modules.
Impact
The compromise chain, named KANDYKORN, consists of five stages: Watcher.py (initial entry), testSpeed.py and FinderTools (dropper), .sld and .log (payload), HLOADER (loader), and the final KANDYKORN payload. The malware loads binaries directly into memory, a technique uncommon on macOS, and evades standard detection. Affected systems include any macOS endpoint that ran the Python script, primarily blockchain engineers working on a crypto exchange platform.
What to Do
- Block inbound traffic to the Discord server used for delivery and monitor for any new public channels that mention arbitrage bots.
- Configure endpoint protection to flag execution of Watcher.py and any subsequent Python modules.
- Implement application whitelisting for macOS and enforce that only signed binaries run.
- Deploy memory‑analysis tools to detect in‑memory loading of unknown binaries.
- Educate staff on social‑engineering tactics and verify the source of any code before execution.
Technical Details
Stages of the KANDYKORN intrusion:
- Stage 0 – Watcher.py: initial compromise via Python script.
- Stage 1 – testSpeed.py & FinderTools: dropper modules.
- Stage 2 – .sld & .log (SUGARLOADER): payload delivery.
- Stage 3 – HLOADER (loader via fake Discord).
- Stage 4 – KANDYKORN: final malware execution.
Related articles
macOS.Gaslight: DPRK-Linked Rust Backdoor Targets LLM Triage Agents with Prompt Injection
Security researchers have detailed macOS.Gaslight, a Rust-based macOS implant and credential stealer linked to DPRK threat actors. The malware uniquely embeds 38 fabricated system messages designed to manipulate LLM-assisted analysis pipelines into aborting triage. Defenders should monitor for ad-hoc signed Mach-O binaries, unexpected Telegram Bot API polling loops, and unauthorized data exfiltration attempts.
Read briefing
Zero-Click Candiru Spyware Reaches Al Jazeera via Targeted Online Ads
Researchers confirm that Candiru spyware infected at least 45 Al Jazeera devices through invisible ads, requiring no user interaction. The attack chain began with a Discover‑Tech ad server that identified targets and delivered malicious code to browsers or apps. Defenders should audit ad networks, block suspicious ad domains, and monitor for unexpected outbound connections to known spyware command‑and‑control hosts.
Read briefing
U.S. Government Disrupts DPRK‑Linked FAMOUS CHOLLIMA Laptop Farms with CrowdStrike Support
The FBI and CrowdStrike dismantled several laptop farms operated by the DPRK‑affiliated threat group FAMOUS CHOLLIMA, exposing fraudulent use of compromised laptops within U.S. companies. Defenders should audit remote‑access logs, isolate affected devices, and strengthen endpoint detection and response controls.
Read briefing
CrowdStrike and FBI Disrupt DPRK‑Nexus FAMOUS CHOLLIMA Laptop Farms Targeting U.S. Companies
U.S. authorities, with CrowdStrike support, dismantled laptop farms run by the DPRK‑linked threat actor FAMOUS CHOLLIMA that were used to deploy malicious operatives into American firms. The operation exposed compromised endpoints and highlighted the need for rigorous endpoint monitoring. Defenders should audit laptop usage, enforce strict device authentication, and leverage CrowdStrike Falcon for detection.
Read briefing