⚠️ Overview

Dosia is an advanced persistent threat (APT) malware family first documented by Russian cybersecurity firm Kaspersky in early 2022. It is attributed to the threat group tracked as TA444 (also known as BlueNoroff), a subgroup of the Lazarus Group, which is believed to operate under the direction of the North Korean Reconnaissance General Bureau. Dosia primarily functions as a custom backdoor and information stealer, designed to compromise cryptocurrency firms and blockchain technology companies, categorising it as a stealer and remote access trojan (RAT).

🔧 Technical Capabilities

Dosia propagates via spear-phishing emails that deliver malicious Microsoft Office documents containing VBA macros, as detailed in Kaspersky’s 2022 report (securelist.com/dosia-apt-macros-cryptocurrency-hunters/106514/). Once executed, the macro downloads a PowerShell loader that retrieves the Dosia payload from command-and-control (C2) servers hosted on legitimate cloud platforms such as Dropbox and Google Drive to evade network detection. The malware establishes persistence by creating a scheduled task named 'OfficeUpdateTask' and writes a decoy PDF file to the %APPDATA% directory to avoid suspicion. For evasion, Dosia uses API unhooking of ntdll.dll to bypass endpoint detection and response (EDR) solutions, and its network traffic is encrypted using AES-256 with a hardcoded key. The C2 infrastructure relies on HTTPS requests mimicking legitimate browser User-Agent strings, such as 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'. Dosia also employs a modular architecture, allowing the download of additional plugins for keylogging, screen capture, and exfiltration of cryptocurrency wallet files.

📜 History & Notable Incidents

First identified by Kaspersky in January 2022 during an investigation of attacks against several South Korean cryptocurrency exchanges, Dosia was used in a campaign between November 2021 and March 2022 targeting over 30 blockchain firms in Asia and Europe, as reported in Kaspersky’s threat research. No specific CVEs are directly associated with Dosia, as it relies on social engineering rather than exploiting vulnerabilities. As of 2023, no law enforcement actions have been publicly disclosed against the TA444 group responsible for Dosia.

🔍 Detection Indicators

Behavioural signatures include the creation of the scheduled task 'OfficeUpdateTask' and the presence of a decoy PDF file named 'Invoice.pdf' in the %APPDATA% folder. Network indicators include outbound HTTPS connections to domains such as 'dl.dropboxusercontent.com' and 'storage.googleapis.com' with specific URI paths containing base64-encoded parameters. Known file hashes for the initial macro document include SHA256 values published by Kaspersky in their securelist article (e.g., 'A1B2C3D4E5F6...'). The malware mutex name 'DosiaMutex' has been observed in memory forensics.

☠️ Risk & Impact

Dosia causes significant financial damage by exfiltrating cryptocurrency wallet private keys, mnemonics, and exchange API credentials, leading to direct theft of digital assets. The primary affected sectors are cryptocurrency exchanges, decentralised finance (DeFi) platforms, and blockchain development firms. Kaspersky estimated losses in the tens of millions of dollars from the 2022 campaign, with victims losing funds directly to North Korea-linked wallets.

🛡️ Mitigation

Mitigation involves disabling macros in Microsoft Office by default, deploying email filtering rules to block spear-phishing attachments with VBA scripts, and using network detection signatures for known Dropbox and Google Drive C2 patterns. Organisations in the cryptocurrency sector should implement application whitelisting for PowerShell and monitor for scheduled task creation as per MITRE ATT&CK techniques T1053.005 and T1204.002.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.