North Korean Hackers Deploy New Golang Malware 'Durian' Against Crypto Firms

Kimsuky (a North Korean APT) has been observed deploying a newly documented Golang backdoor called Durian in highly targeted attacks against two South Korean cryptocurrency firms (Aug & Nov 2023); Durian provides backdoor capabilities, additional payload delivery, and browser credential exfiltration, and was distributed via a legitimate South Korean application as an infection vector, with follow-on deployment of tools such as AppleSeed, LazyLoad, ngrok, and Chrome Remote Desktop.