Lazarus Is on the Move: Zoom Calls Used to Target Crypto Founders

One of the most prolific North Korean cryptocurrency hacking collectives, Lazarus, is reportedly on the move again, targeting

Kenny Li, co-founder of Manta Network, recently took to X (formerly Twitter) to raise alarms about a modus operandi of Lazarus, the North Korean hacking collective, and its use of Zoom.

According to Li, he was targeted by a known contact using a Zoom-like app that requested access to his camera, which he found suspicious given their previous interactions and the context of the call.

“When I got on the Zoom, it asked me for camera access which I found a bit odd because I have used Zoom many times and it never does that. I could already see the faces of the people who supposedly needed to be in the call, so I don’t know why it would need my camera,” explained Li.

The strange behavior of the app made Li abandon the call without making any changes to his Zoom install.

“I immediately left. Messaged the guy on Telegram and told him to call me on TG to verify him. He then proceeded to erase all the messages and block me.”

Li’s incident hints at a high level of sophistication in the targeted attacks of Lazarus against cryptocurrency founders, including even social engineering and pre-recorded videos of other founders to make prospective victims feel safer and relaxed when facing these events.

Earlier this month, blockchain analytics firm Chainalysis reported that Lazarus is becoming less active in its preferred cryptocurrency mixers to launder the stolen funds.

The firm explained that the hacking collective might be trying to avoid detection by U.S. authorities, who are putting more pressure on cryptocurrency mixers to comply with sanctions and report suspicious activity.

The report also stated that Lazarus had moved about 9,400 BTC, valued at approximately $793 million, to a new hot wallet by April 2024.

The post Kenny Li, co-founder of Manta Network, warns of new Lazarus scam and a request for camera access on Zoom appeared first on TokenPost.web3.