TA444Threat actor
TA444 is a North Korea state-sponsored threat actor that primarily focuses on financially motivated operations. They have been active since at least 2017 and have recently shifted their attention to targeting cryptocurrencies. TA444 employs various infection methods and has a diverse range of malware and backdoors at their disposal.From MISP Galaxy
Last reported 16 months ago, by Huntress1 report
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1027.009Embedded Payloads
“There are two main things this binary does: in the first, it takes another binary and a password as arguments and will decrypt embedded payloads.”
- T1055Process Injection
“This occurs for both base64 blobs which are later used in the process injection portion.”
- T1056.001Keylogging
“It will start running the keylogging binary and one of the binaries contained in the .version file:”
- T1176.001Browser Extensions
“As is typical with stealers to do this, they iterate over installed browser extensions looking for wallet plugins.”
- T1552.003Shell History
“Lastly, it removes the shell history, so users are unaware of what ran.”
- T1684Social Engineering
“Identifying and mitigating Meeting application social engineering”
What the reports say
1 report, newest first · the exact sentence from each-
Inside the BlueNoroff Web3 macOS Intrusion Analysis“We attribute with high confidence that this intrusion was conducted by the North Korean (DPRK) APT subgroup tracked as TA444 aka BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, or CageyChameleon—a state-sponsored threat actor known for targeting cryptocurrencies stemm…”
Indicators in its reports
named in the reports above- support.us05web-zoom[.]bizin 1 report
- 3dd226d0b700f339…750eb1702e2ain 1 report
- c4db903322d17c8c…06df24c572dfin 1 report
- firstfromsep[.]onlinein 1 report
- hxxps://metamask.awaitingfor[.]site/updatein 1 report
- metamask.awaitingfor[.]sitein 1 report
- productnews[.]onlinein 1 report
- 4cd5df82e1d4f933…497fb5cb438cin 1 report
- ad01beb19f5b8c71…d9f737f2d320in 1 report
- ad21af758af28b76…11c2e18f42ffin 1 report
- 432c720a9ada4078…ee0a451bb249in 1 report
- 1ddef717bf82e61b…0c036da5ce05in 1 report
- 14e9bb6df4906691…afad41fa1527in 1 report
- 2e30c9e3f0324011…cb89392af23din 1 report
- 469fd8a280e89a6e…7006b573865fin 1 report
- 080a52b99d997e1a…9d47a71122afin 1 report
- safeupload[.]onlinein 1 report
- safefor[.]xyzin 1 report
- readysafe[.]xyzin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.