Binance says attackers used a sophisticated fake-recruitment campaign to compromise an engineer’s computer, move into two additional engineer devices, and gain unauthorized access to internal wallet-signing services. The operation began with job interviews conducted through legitimate platforms and ultimately enabled the attackers to deploy a container and initiate a transfer outside the company’s normal withdrawal process.
Attackers posed as company executives during fake interviews
In September, another engineer received a message through a legitimate job-search platform. The sender posed as a project director seeking to hire an employee and arranged an initial interview with an alleged human-resources representative, followed by a second interview with an alleged CEO of a fictitious company.
The first interview took place on a video platform. During the call, the alleged human-resources representative shared social-media accounts containing personal photos and videos. The second interview was held through a social-chat application.
The engineers were then instructed to download an “issue” linked to a code repository. The repository contained malicious code that was eventually executed on the engineer’s device during the setup process.
“The malware employed sophisticated obfuscation and evasion techniques, including replacing legitimate development tools components with malicious versions, in order to execute commands and establish communication with external servers controlled by the attackers,” Binance said. “At the time, zero-day malware was not detected by endpoint security protection tools. Attackers took steps to hide their malicious activity and remove any evidence of compromise, making detection and subsequent investigation more difficult.”
Compromised devices enabled access to wallet services
On October 20, the attackers used the compromised engineer’s computer and internal AI tools to take control of two other engineer devices. One of those devices had previously been targeted by a trojanized Homebrew installer.
The engineer’s wallet contained a token that granted access to the container deployment. Nine days later, between 17:15 and 19:56 UTC, the threat actor logged into the third engineer’s device and used stolen credentials to launch a script that deployed the container and initiated the transfer.
As part of the operation, the attackers extended their unauthorized access to internal wallet-signing services, allowing them to complete transactions outside the normal withdrawal process.
Source: arstechnica.com