Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto

Back in August, researchers spotted an instance of Operation In(ter)ception using lures for job vacancies at cryptocurrency exchange platform Coinbase to infect macOS users with malware. In recent days, researchers has seen a further variant in the same campaign using lures for open positions at rival exchange Crypto.com. In this post, we review the details of this ongoing campaign and publish the latest indicators of compromise.

REFERENCE: https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/

TAGS: lazarus, coinbase, crypto.com, Operation In(ter)ception, PDF decoy

ADVERSARY: Lazarus

INDUSTRIES: Cryptocurrency, Defense, Aerospace

ATT&CK IDS: T1027 - Obfuscated Files or Information, T1104 - Multi-Stage Channels, T1150 - Plist Modification, T1036 - Masquerading

Read More:

https://otx.alienvault.com/pulse/6336cd77cbc019c475aa2034