North Korea’s Lazarus Group has been identified as the orchestrator of a sophisticated malware campaign targeting blockchain engineers through a fake cryptocurrency arbitrage bot distributed via Discord. The malware, dubbed KANDYKORN by Elastic Security Labs, represents one of the most technically complex attacks aimed at crypto professionals in 2023, exploiting macOS systems through a multi-stage infection chain that evades conventional security tools.
The Exploit Mechanics
The attack begins with social engineering on public Discord servers frequented by blockchain engineers. Threat actors impersonate community members and lure victims into downloading a ZIP archive titled “Cross-Platform Bridges.zip.” The archive contains what appears to be a legitimate cryptocurrency arbitrage bot — a tool designed to profit from price differences across exchanges — complete with a Main.py script and an order_book_recorder folder housing 13 Python scripts. When the victim runs Main.py in their Python IDE, the infection chain activates silently.
The execution unfolds across five distinct stages. Stage 0 involves Watcher.py, a script that establishes local directory paths and creates a hidden _log folder. Stage 1 deploys testSpeed.py and a component called FinderTools as a dropper. Stage 2 loads obfuscated payloads disguised as .sld and .log files, known as SUGARLOADER. Stage 3 uses a fake Discord application as a loader, designated HLOADER. The final stage delivers KANDYKORN, the primary payload capable of data exfiltration and persistent access.
What makes this attack particularly dangerous is its use of reflective binary loading into memory on macOS, a technique that is atypical for macOS intrusions and difficult for traditional endpoint detection systems to identify. Each stage employs deliberate defense evasion techniques, making the full attack chain hard to trace without advanced behavioral analysis.
Affected Systems
The campaign specifically targets macOS systems used by blockchain engineers and employees of cryptocurrency exchange platforms. Elastic Security Labs tracks this intrusion set as REF7001 and has confirmed overlaps with known Lazarus Group infrastructure based on analysis of techniques, network infrastructure, and code-signing certificates. The attack leverages the trust that developers place in open-source Python applications and community-shared tools, exploiting the collaborative culture of blockchain development communities.
Victims are typically professionals working in crypto exchange engineering teams who participate in Discord communities for blockchain developers. The attack exploits both the technical sophistication and the social trust within these communities, as blockchain engineers are often willing to test new tools and scripts shared by apparent peers.
The Mitigation Strategy
Organizations and individual developers should implement several defensive measures against this type of attack. First, never execute code from untrusted sources, even when shared by apparent community members on Discord or other platforms. Always verify the identity of the person sharing files and scan all downloaded archives with up-to-date antivirus solutions before execution.
For macOS specifically, enable Gatekeeper and XProtect, and consider deploying endpoint detection and response solutions that can identify reflective memory loading. Elastic Security Labs has published detection rules for REF7001 that organizations should deploy immediately. Development environments should be isolated from systems that handle cryptocurrency wallets or exchange credentials.
Lessons Learned
The KANDYKORN campaign demonstrates that North Korean threat groups continue to refine their targeting of the cryptocurrency ecosystem. With Bitcoin trading at approximately $36,500 and Ethereum at $2,055 in mid-November 2023, the financial incentives for these attacks remain substantial. The Lazarus Group has been linked to billions of dollars in cryptocurrency thefts over the past several years, and their techniques continue to evolve.
The attack also highlights a broader shift in threat actor targeting: rather than attacking exchange infrastructure directly, sophisticated groups are increasingly targeting the individuals who build and maintain that infrastructure. This human-centric attack vector requires a fundamentally different defensive approach focused on developer education and behavioral monitoring rather than purely technical controls.
User Action Required
Blockchain developers and crypto professionals should immediately audit their development environments for signs of compromise. Review recently downloaded files, especially Python scripts received through Discord or other messaging platforms. Check for unexpected processes running on macOS systems, particularly any unusual Python or Discord-related processes. If you have executed code from an unverified source in recent weeks, consider the affected machine compromised and rebuild from a known-good image. Report any suspicious activity to your organization’s security team and to platforms where the initial social engineering contact occurred.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult security professionals for specific guidance.
13 Python scripts with a fake GitHub commit history and months of Discord rapport building. Lazarus runs social engineering ops like a real software company. the dedication is chilling
Yuki S. macOS Gatekeeper did not catch any of the 5 stages. Apple marketing Mac as inherently secure to developers is irresponsible when Python execution bypasses every layer they built
weeks of trust building in Discord for a handful of wallets. each blockchain engineer wallet can hold 6 figures. the ROI per target is massive which is why Pyongyang keeps funding these ops
lazarus really said ‘lets build a whole fake arbitrage bot with 13 python scripts’ just to own a few devs. the dedication is almost impressive
13 scripts and a full main.py with order book recorder. this wasnt some rushed job, they spent weeks building credibility first
lazarus builds elaborate cover stories because it works. they spent months in that discord building trust before dropping the zip. social engineering at scale
months of trust building for a handful of wallets. the ROI must still be worth it given pyongyangs budget constraints
rusticle 13 scripts and weeks of trust building for like 5 wallet drainers. the ROI must be insane because pyongyang runs these ops like a real software shop
drasko p that trust building over weeks for small wallets is classic lazarus patience
the fake github repo with commit history was a nice touch too. lazarus does not cut corners on cover stories
fake github with full commit history, months of prep for a wallet drain
13 python scripts to look legit. lazarus spent weeks building a fake github with real commit history just to drain a few wallets. insane ROI for them
macOS users thinking theyre safe from malware in 2023 was always cope. kandykorn proves social engineering beats any OS security
Kyoko M. macOS gatekeeper is a joke against anything signed with a stolen cert. apple needs real behavioral detection not just notarization theater
lazarus fake bot on discord hitting blockchain devs, gatekeeper useless
macos users think gatekeeper protects them. stage 2 of kandykorn sidesteps it entirely using python which apple doesn’t sandbox
if youre downloading zip files from random discord DMs you kind of deserve what happens tbh
harsh take but not wrong. downloading and running code from a discord DM is security 101 failure
Ina M. downloading zips from discord is one thing but lazarus spent months building rapport first. even careful devs got hit because the social proof was real
skid_row_ victim blaming aside, lazarus targets experienced devs not noobs. the social engineering is sophisticated enough to fool people who should know better
the fake github with real commit history is what gets me. lazarus literally hired devs to maintain a cover repo for weeks. state level social engineering
bytecutter_ and despite all that effort they only caught a handful of wallets. the ROI per target must be massive for pyongyang to justify the labor cost
five stage infection chain and macOS Gatekeeper caught none of it. apple needs to stop marketing their platform as inherently secure to devs
fake arbitrage bot on discord and blockchain engineers still fell for it. if the people building this stuff get phished what hope do normies have
pylon_sec_ the irony is the arbitrage bot concept itself should be a red flag. real arb tools dont get shared in discord servers for free