Cryptocurrency Exchanges, Students Targets of North Korea Hackers

Late-2017 state-sponsored cyber campaign attributed to North Korea's Lazarus Group targeted South Korean cryptocurrency users, exchanges (including Coinlink), and college students via spear-phishing using malicious Hangul (.hwp) files that exploited a Ghostscript vulnerability (CVE-2017-8291); the malware reused Destover code and is linked to wider ransomware and cryptocurrency theft activity including connections to the WannaCry incidents.