---
title: Lazarus Group Targets Crypto With TraderTraitor
description: US agencies recently released a joint advisory on TraderTraitor, a Lazarus group campaign targeting blockchain companies.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Lazarus Group Targets Crypto With TraderTraitor](https://blog.polyswarm.io/lazarus-group-targets-crypto-with-tradertraitor)

 Written by [PolySwarm Tech Team](https://blog.polyswarm.io/author/polyswarm-tech-team) | Apr 25, 2022 3:26:42 PM

## Background CISA, FBI, and the US Treasury Department recently released a joint [advisory](https://www.ic3.gov/Media/News/2022/220418.pdf)on TraderTraitor, a Lazarus group campaign targeting blockchain companies. What is TraderTraitor? According to the advisory, North Korean threat actor groups have been targeting cryptocurrency since at least 2020, with most of the activity perpetrated by Lazarus Group. Victims have included cryptocurrency exchanges, decentralized finance (DeFi) protocols, play-to-earn cryptocurrency games, cryptocurrency trading companies, venture capital funds investing in cryptocurrency, and individual holders of large amounts of cryptocurrency or valuable NFTs. Lazarus Group used a trojanized cryptocurrency application, dubbed AppleJeus, in a previous campaign targeting cryptocurrency. In the most recent campaign, TTPs included spearphishing, social engineering the victims, and coaxing them to download trojanized cryptocurrency applications belonging to the TraderTraitor family of malware. TraderTraitor is written using cross-platform JavaScript code with the Node.js runtime environment using the Electron framework. In the advisory, the agencies identified multiple trojanized applications used in the campaign. These include DAFOM, TokenAIS, CryptAIS, AlticGo, Esilet, and CreAI Deck. Observed payloads included new Mac and Windows versions of the Manuscrypt RAT. Manuscrypt collects system information and can execute arbitrary commands and download additional payloads. Most of the victims who were targeted held system administrator or DevOps roles. Following the installation of the malicious program, the threat actors obtained access to the victim’s computer, spread malware across the victim’s network environment, exploited multiple security gaps, and stole information, including credentials. Ultimately the threat actors sought to initiate fraudulent blockchain transactions. Who is Lazarus Group? Lazarus group, also known as Dark Seoul, Labyrinth Chollima, and APT 38, is a state-sponsored threat actor group likely affiliated with North Korea’s Reconnaissance General Bureau. The group’s members are reportedly trained in Shenyang, China in malware and espionage operations. Lazarus is known for espionage activity, disruptive activity, and financially motivated attacks. Other known Lazarus TTPs include DDoS attacks, wiper malware, botnets, keyloggers, and RATs. The group’s first known activity was Operation Troy, an espionage campaign targeting the South Korean government as early as 2009. Lazarus group’s espionage activity is in line with intelligence collection requirements for the North Korean government, targeting South Korea, the US, and other nations. Lazarus is thought to be responsible for the 2014 Sony Pictures attack and the 2017 WannaCry ransomware campaign. Lazarus has also targeted banks in Ecuador, Vietnam, Bangladesh, Mexico, Poland, and Taiwan. IOCs PolySwarm has multiple samples associated with the TraderTraitor campaign. [867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36](https://polyswarm.network/scan/results/file/867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36) [89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957](https://polyswarm.network/scan/results/file/89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957) [9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa](https://polyswarm.network/scan/results/file/9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa) [dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156](https://polyswarm.network/scan/results/file/dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156) You can use the following CLI command to search for all TraderTraitor samples in our portal: *$ polyswarm link list -f TraderTraitor*

## **Don’t have a PolySwarm account? Go** [**here**](https://polyswarm.network/) **to sign up for a free Community plan or to subscribe.** Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports

[View full post](https://blog.polyswarm.io/lazarus-group-targets-crypto-with-tradertraitor)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "PolySwarm Tech Team"
  },
  "dateModified" : "2022-04-25T15:26:42.544Z",
  "datePublished" : "2022-04-25T15:26:42Z",
  "headline" : "Lazarus Group Targets Crypto With TraderTraitor",
  "image" : {
    "@type" : "ImageObject",
    "height" : 3154,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Lazarus_Blog.jpg",
    "width" : 5532
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/lazarus-group-targets-crypto-with-tradertraitor",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```