Plan
archived
BlueNoroff Phishing Kit Profiles Crypto Wallets Before Malware Drop
- Engineer — Plan: Configure DNS/URL filtering to block typosquatted Zoom and Teams domains; audit endpoint policies to detect script execution spawned from video-conferencing app processes, which is an anomalous ClickFix-style delivery path.
- SOC/IR — Plan: Build or tune detections for ClickFix-style prompts (unexpected clipboard/script-paste behavior) and process chains where msiexec or PowerShell launches as a child of a meeting application; no IOCs are published yet but the TTPs are specific enough to act on this quarter.
- Leader — Learn: North Korean BlueNoroff is maturing its crypto-sector targeting by combining compromised industry contacts with wallet-profiling before payload delivery — useful context for risk posture briefings if your org has cryptocurrency holdings or operates in financial services.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.