Analysis_Report_Operation_Moneyholic.pdf (2 MB)

AhnLab tracks Operation Moneyholic as activity observed from early 2018 through August 2019 against cryptocurrency exchanges and users for financial theft. The attacks used email attachments with double extensions or hidden spacing to masquerade as documents, then showed decoy cryptocurrency-related files while downloading batch scripts and additional malware. The excerpt details TiWorker.exe, a backdoor based on publicly available Chinese source code that sends the fxftest signature to its C2 and supports drive listing, file operations, process control, command execution, and connectivity tests. Another chain used base64-encoded HWP decoys and ipnet.dll, whose variants communicated with C2 over web or FTP and were compared with malware seen in a 2014 lure about North Korean satellite-launch-site construction. The report matters because it ties multiple document-lure techniques, backdoor families, hosting paths, C2 behavior, and operator artifacts into a cryptocurrency-focused intrusion cluster while presenting technical evidence for possible links to a state-run hacking group.