FBI Attributes Record $6.43 Billion Binance Heist to North Korea's TraderTraitor: Detection and Hardening Guide

---
title: Suspicious npm Package Execution from Temp Directory
id: 8f3a9b2c-1d4e-4f5a-9b8c-2e3f4a5b6c7d
status: experimental
description: Detects execution of npm or node processes from temporary or user directories, consistent with TraderTraitor's malicious package deployment.
references:
  - https://attack.mitre.org/techniques/T1059/007/
  - https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.execution
  - attack.t1059.007
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npx.exe'
    CommandLine|contains:
      - 'Temp\'
      - 'AppData\Local\Temp'
      - 'Downloads\'
      - 'tmp\'
  condition: selection
falsepositives:
  - Legitimate development activities in temp directories
level: medium
---
title: macOS Suspicious curl/wget to Cryptocurrency C2
id: 9b4c5d6e-7f8a-9b0c-1d2e-3f4a5b6c7d8e
status: experimental
description: Detects suspicious network connections via curl or wget to known cryptocurrency-targeting C2 patterns, including blockchain API abuse.
references:
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/wget'
    CommandLine|contains:
      - 'blockchain.info'
      - 'ethplorer.io'
      - 'api.binance'
      - 'pastebin.com/raw'
      - 'raw.githubusercontent.com'
      - 'transfer.sh'
  condition: selection
falsepositives:
  - Legitimate cryptocurrency development or price checking
level: medium
---
title: LSASS Memory Dump for Cryptocurrency Credential Theft
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects access to LSASS memory potentially for extracting credentials or cryptocurrency wallet keys, a technique used by TraderTraitor for privilege escalation.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1410'
      - '0x143a'
      - '0x1fffff'
  filter:
    SourceImage|endswith:
      - '\svchost.exe'
      - '\wininit.exe'
      - '\csrss.exe'
      - '\services.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate security tools with LSASS access
level: high

// Hunt for suspicious npm/node executions in temporary directories (Windows & macOS)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("node.exe", "npm.exe", "npx.exe", "node", "npm")
| where ProcessCommandLine has_any ("Temp", "tmp", "AppData\\Local\\Temp", "Downloads")
| where not(FolderPath has_any ("Program Files", "Program Files (x86)", "node_modules"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessAccountName, SHA256
| order by TimeGenerated desc

// Detect potential cryptocurrency wallet credential dumping via LSASS access
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4663
| where ObjectName has "lsass.exe"
| where AccessMask has_any ("0x1010", "0x1410", "0x143a", "0x1fffff")
| where not(ProcessName has_any ("svchost.exe", "wininit.exe", "csrss.exe", "MsMpEng.exe"))
| project TimeGenerated, Computer, SubjectUserName, ProcessName, ObjectName, AccessMask

// Hunt for suspicious network connections to blockchain/C2 infrastructure
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("blockchain.info", "ethplorer.io", "api.binance.com", "pastebin.com", "transfer.sh")
| where InitiatingProcessFileName in~ ("curl.exe", "wget.exe", "powershell.exe", "node.exe")
| where not(RemoteIP has_any ("10.", "172.16.", "192.168."))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort

// macOS-specific hunt for suspicious curl/wget execution
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceType == "Mac"
| where FileName in~ ("curl", "wget", "python", "python3")
| where ProcessCommandLine has_any ("http", "https", "api", "crypto", "wallet", "blockchain")
| where not(InitiatingProcessFileName has_any ("Xcode", "Visual Studio", "Terminal", "iTerm"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName

-- Hunt for suspicious processes and network connections associated with TraderTraitor
SELECT 
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime,
    netstat().RemoteAddress AS RemoteIP,
    netstat().RemotePort AS RemotePort,
    netstat().State AS ConnectionState
FROM pslist()
WHERE (
    (Name =~ 'node|npm|npx' AND CommandLine =~ 'Temp|tmp|Downloads')
    OR (Name =~ 'curl|wget' AND CommandLine =~ 'blockchain|crypto|wallet|pastebin')
    OR (Exe =~ '/tmp/|/var/tmp/|Temp\\\\\\\\')
)
    OR netstat().RemotePort in (443, 8080, 8443)
    AND netstat().State == 'ESTABLISHED'
    AND NOT netstat().RemoteAddress =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

-- Check for common TraderTraitor persistence locations
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(globs=[
    '/Users/*/Library/LaunchAgents/*.plist',
    '/Library/LaunchDaemons/*.plist',
    'C:/Users/*/AppData/Roaming/npm-cache/*',
    'C:/Users/*/AppData/Local/Temp/*.js'
])
WHERE Mtime > now() - 604800  -- Files modified in last 7 days
ORDER BY Mtime DESC

# TraderTraitor IOC Audit and Hardening Script - Windows
# Run as Administrator

Write-Host "[+] Starting TraderTraitor IOC Audit..." -ForegroundColor Cyan

# 1. Check for suspicious npm/node processes
Write-Host "[+] Checking for suspicious Node.js executions..." -ForegroundColor Yellow
$SuspiciousNode = Get-Process | Where-Object {
    $_.ProcessName -match 'node|npm' -and 
    $_.Path -match 'Temp|AppData\\Local\\Temp'
}
if ($SuspiciousNode) {
    Write-Host "[!] ALERT: Suspicious Node.js processes detected:" -ForegroundColor Red
    $SuspiciousNode | Select-Object ProcessName, Id, Path, CommandLine | Format-Table -AutoSize
} else {
    Write-Host "[OK] No suspicious Node.js processes found." -ForegroundColor Green
}

# 2. Audit LSASS access attempts
Write-Host "[+] Checking recent LSASS access events..." -ForegroundColor Yellow
$LSASSAccess = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4663} -MaxEvents 1000 | 
    Where-Object {$_.Message -match 'lsass.exe' -and $_.Message -match '0x1fffff|0x1010'}
if ($LSASSAccess) {
    Write-Host "[!] WARNING: Potential LSASS access detected (possible credential dumping):" -ForegroundColor Red
    $LSASSAccess | Select-Object TimeCreated, Id, Message | Format-List
} else {
    Write-Host "[OK] No suspicious LSASS access detected." -ForegroundColor Green
}

# 3. Check for suspicious network connections to cryptocurrency APIs
Write-Host "[+] Checking network connections to cryptocurrency/blockchain endpoints..." -ForegroundColor Yellow
$SuspiciousConnections = Get-NetTCPConnection -State Established | 
    Where-Object {$_.RemotePort -eq 443 -or $_.RemotePort -eq 8080} | 
    Select-Object RemoteAddress, RemotePort, OwningProcess, @{Name='ProcessName';Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}

$CryptoPatterns = @('blockchain', 'binance', 'ethereum', 'api.crypto')
foreach ($conn in $SuspiciousConnections) {
    try {
        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction Stop
        if ($proc.ProcessName -match 'curl|wget|node|powershell') {
            Write-Host "[!] INFO: $($proc.ProcessName) (PID: $($conn.OwningProcess)) connected to $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Magenta
        }
    } catch {}
}

# 4. Harden Windows Defender Attack Surface Reduction (ASR) rules
Write-Host "[+] Enabling recommended ASR rules for cryptocurrency protection..." -ForegroundColor Yellow
$ASRRules = @(
    @{Name="Block credential stealing from LSASS"; Guid="9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2"},
    @{Name="Block process creations from PSExec and WMI"; Guid="d1e49aac-8f56-4280-b9ba-993a6d77406c"},
    @{Name="Block execution of potentially obfuscated scripts"; Guid="5beb7efe-fd9a-4556-801d-275e5ffc04cc"},
    @{Name="Block JavaScript/VBScript from launching downloaded executables"; Guid="d3e037e1-3eb8-44c8-a917-57927947596d"}
)

foreach ($rule in $ASRRules) {
    try {
        Set-MpPreference -AttackSurfaceReductionRules_Ids $rule.Guid -AttackSurfaceReductionRules_Actions Enabled
        Write-Host "[OK] Enabled: $($rule.Name)" -ForegroundColor Green
    } catch {
        Write-Host "[!] Failed to enable: $($rule.Name) - $($_.Exception.Message)" -ForegroundColor Red
    }
}

# 5. Audit PowerShell logging
Write-Host "[+] Verifying PowerShell logging configuration..." -ForegroundColor Yellow
$PSLogging = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -ErrorAction SilentlyContinue
if (-not $PSLogging -or $PSLogging.EnableScriptBlockLogging -ne 1) {
    Write-Host "[!] PowerShell Script Block Logging not enabled. Enabling now..." -ForegroundColor Red
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
    Write-Host "[OK] PowerShell Script Block Logging enabled." -ForegroundColor Green
}

Write-Host "[+] Audit complete. Review any alerts above and isolate affected systems immediately." -ForegroundColor Cyan

#!/bin/bash
# TraderTraitor IOC Audit - macOS/Linux

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

echo -e "${YELLOW}[+] Starting TraderTraitor IOC Audit for macOS/Linux...${NC}"

# 1. Check for suspicious node/npm processes
echo -e "${YELLOW}[+] Checking for suspicious Node.js processes...${NC}"
if pgrep -f "node|npm" | xargs ps -o pid,comm,args -p 2>/dev/null | grep -E "tmp|Temp|Downloads" > /dev/null; then
    echo -e "${RED}[!] ALERT: Suspicious Node.js processes detected:${NC}"
    pgrep -f "node|npm" | xargs ps -o pid,comm,args -p 2>/dev/null | grep -E "tmp|Temp|Downloads"
else
    echo -e "${GREEN}[OK] No suspicious Node.js processes found.${NC}"
fi

# 2. Check LaunchAgents/LaunchDaemons for persistence (macOS)
if [[ "$OSTYPE" == "darwin"* ]]; then
    echo -e "${YELLOW}[+] Checking for suspicious LaunchAgents...${NC}"
    SUSPICIOUS_PLISTS=$(find ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons -name "*.plist" -mtime -7 2>/dev/null | head -20)
    if [ -n "$SUSPICIOUS_PLISTS" ]; then
        echo -e "${RED}[!] Recently modified plist files (review for unauthorized persistence):${NC}"
        echo "$SUSPICIOUS_PLISTS"
    else
        echo -e "${GREEN}[OK] No recently modified suspicious plists detected.${NC}"
    fi
fi

# 3. Check for suspicious network connections
echo -e "${YELLOW}[+] Checking network connections to cryptocurrency endpoints...${NC}"
if command -v lsof > /dev/null; then
    CRYPTO_CONNECTIONS=$(lsof -i -P | grep -E "ESTABLISHED" | grep -E "node|curl|wget|python" | head -10)
    if [ -n "$CRYPTO_CONNECTIONS" ]; then
        echo -e "${YELLOW}[!] Active connections from development tools (review for C2):${NC}"
        echo "$CRYPTO_CONNECTIONS"
    fi
fi

# 4. Harden macOS settings
echo -e "${YELLOW}[+] Applying hardening configurations...${NC}"

# Disable automatic execution of downloaded files
if [[ "$OSTYPE" == "darwin"* ]]; then
    defaults write com.apple.LaunchServices LSQuarantine -bool true
    echo -e "${GREEN}[OK] Quarantine attribute enforcement enabled.${NC}"
fi

# 5. Check for suspicious recent file modifications in development directories
echo -e "${YELLOW}[+] Checking for recently modified suspicious files...${NC}"
find /tmp /var/tmp ~/Downloads -type f -name "*.js" -o -name "*.json" -o -name "package.json" -mtime -3 2>/dev/null | while read file; do
    echo -e "${YELLOW}[!] Recent file: $file${NC}"
    # Check for suspicious strings
    if grep -qE "eval|exec|child_process|spawn|request|https?://" "$file" 2>/dev/null; then
        echo -e "${RED}    [ALERT] Suspicious content detected in $file${NC}"
    fi
done

echo -e "${GREEN}[+] Audit complete. Review alerts above and consider isolating affected systems.${NC}"