In September, a separate engineer received messages through a legitimate job-hunting platform he was using. The message came from an individual posing as a project manager looking for new employees. The supposed project director arranged a first-round interview with a supposed HR representative and a second-round interview with the supposed CEO of the fictitious company.
During the first interview, conducted via a video platform, the alleged HR representative shared a social media account that contained personal photos and videos. The second interview took place via a social chat app. During that, the engineer was asked to download a “task” associated with a code repository that contained malicious code, which was eventually executed on the engineer’s device during the setup process.
“The malware used sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” Binance said. “The 0-day malware was not detected by endpoint security protection tools at the time. The attacker also took steps to hide the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.”
On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to take control of two other engineering devices, including the one previously targeted with the trojanized homebrew installer. The engineer’s wallet contains a token that grants access to a container deployment.
Nine days later, between 17:15 and 19:56 UTC, the threat actor logged into the third engineer’s device, used the stolen credentials, deployed a container, and activated a script to initiate the transfer. Among other things, the attackers extended their unauthorized access to an internal wallet signing service to complete transactions outside of the normal withdrawal process.