In what appears to be a continuation of the North Korean strategy to finance the nation using international organized crime rings, cybersecurity researchers established a link between a new malware targeting blockchain engineers and the North Korean state sponsored Lazarus group. Researchers noted that the new malware, which is being used to target the Apple devices of blockchain engineers, shares tactics, techniques, and procedures (TTPs) with the Lazarus group. Researchers stated that these engineers were targeted likely in order to steal cryptocurrency to finance the state’s operations and avoid sanctions. Initial access to the systems was achieved through the use of a Python application that was sent to victims through a Discord server used by blockchain engineers. The Python application was supposedly to be used as a cryptocurrency bot that makes transactions automatically based on price differentials throughout the crypto marketplace. This application targets macOS devices and attempted to drop malware the researchers call KANDYKORN. This malware can access and exfiltrate data from the infected device while connecting back to a command-and-control (C2) server to continually upload, execute, and exfiltrate data and programs while avoiding detection. According to researchers, the campaign began in April 2023 and continues into November. Ankura will continue to monitor this ongoing malware campaign.