BlueNoroff

BlueNoroff is a DPRK-linked malware/threat cluster associated with targeted intrusions, particularly against the cryptocurrency and Web3 sector. The provided content states that BlueNoroff primarily attacks the cryptocurrency industry and has been observed in campaigns using social engineering, including deepfakes and malicious Zoom extensions, to compromise victim organizations. In one Huntress-described case, attackers shifted a meeting from Google Meet to Zoom at the last minute and instructed the victim to install a supposed Zoom extension, contributing to compromise. The content also associates BlueNoroff activity with backdoor malware and information stealers. A comparative analysis in the source material indicates that BlueNoroff uses a large variety of first-stage malicious code during initial access, while only a small number of final-stage stealer malware families were identified; these final-stage stealers are described as changing slowly and being used to extract information in the later phase of attacks. High-confidence targeting information in the content includes cryptocurrency-focused victims and broader high-value sectors such as Web3/cryptocurrency. The content does not provide specific file hashes, domains, or other concrete IOCs.