On January 18th, 2022, CTIX analysts released a FLASH issue summary that BlueNoroff, a subgroup of the North Korean advanced persistent threat (APT) group Lazarus, had been observed targeting cryptocurrency companies. As of late March, Lazarus has continued this activity. By utilizing a legitimate program for decentralized finance called DeFi Wallet, Lazarus delivers malware onto an infected machine without detection. The malware itself is not just a backdoor, but also has the potential to give the actor full control of the compromised machine. Lazarus used compromised web servers in South Korea to coordinate the attack, which resulted in KrCERT and Kaspersky analysts investigating Lazarus’ C2 servers. The malware is designed to carry out in two stages: the first being the trojan loading the backdoor onto the affected machine, and the second being communication between the C2 servers and the infected machines. As the situation develops and the Lazarus group deploys new TTPs, the Ankura CTIX team will continue to monitor their operations, and provide relevant updates to our readers as they develop.