Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label North Korean. Show all posts
Technology
Cyberattacks cybercriminals Cybersecurity CyberThreat Federal Agencies Lazarus Groups North Korean Technology

Federal Agencies Move Against North Korea’s Cybercrime Profits

 


The media have reported that the US government has filed yet another lawsuit to recover nearly $2.69 million worth of stolen digital assets from North Korea's notorious Lazarus hacking group. It was filed on October 4, 2024, and concerns funds taken from two of the largest cryptocurrency heists in 2022 and 2023: the Deribit hack and the Stake.com hack. 

Court documents indicate that the police are pursuing about $1.7 million from the options exchange Deribit in an incident that resulted in a loss of $28 million, which is the amount of Tether (USDT) that was stolen. First of all, we have to deal with a lawsuit filed by a North Korean criminal group relating to the 2022 Deribit hack that saw nearly $28 million drained from the hot wallet of the cryptocurrency exchange. 

For covert purposes, the crooks attempted to launder the money through a combination of virtual currency exchanges, the Tornado Cash mixer, and virtual currency bridges as a means of obscuring their identity. It was thought that the hackers were concealing their actions and laundering the stolen money by using the Tornado Cash mixer and multiple Ethereum addresses that were used by the hackers. 

Avalanche-bridged-Bitcoins (BTC.b) are also being sought by the government as compensation for the loss of revenues from a $4.1 million hacking of the Stake.com gambling platform, which led to a loss of 970,000 Avalanche-bridged-Bitcoins (BTC.b). In these cases, we have only seen a few examples of the alleged activities of the Lazarus Group when it comes to cybercrime. Several blockchain analysts have also implicated this group in the hacking of WazirX in July 2024, which ultimately led to victims losing an estimated $235 million to the hacker group. 

According to a report published by ZackXBT, a blockchain research and investigative team in August, North Korean developers were suspected of hacking into at least 25 cryptocurrencies using fake identities, modifying the code, and taking directly from their Treasury accounts with the use of fake identities. Recently, the FBI has been stepping up its warnings regarding the activities of the Lazarus Group in a bid to alert citizens. 

A report by The Electronic Frontier Foundation on September 20, 2024, exposed some of the highly sophisticated social engineering techniques used by the cybercrime group. These techniques may include cunningly constructed fake job offers, which have been designed to trick users into downloading malicious software masquerading as employment documents to steal data from their computers. 

Approximately a year after the Lazarus Group, an online gambling and casino site, was alleged to have stolen $41 million from Stake.com, it has again been reported. As a result of that heist, a second lawsuit has been filed against the thief. It was discovered that North Koreans and their money laundering co-conspirators stole roughly tens of millions of dollars worth of virtual currency by hacking into Stake.com's computer systems. 

It is explained in the forfeiture action notes [PDF] that the stolen funds were transferred through virtual currency bridges, multiple BTC addresses, and virtual currency mixers before consolidation and depositing at various virtual currency exchanges were conducted. The Lazarus Group moved this stolen cryptocurrency through Bitcoin mixers Sinbad and Yonmix, which were used to handle the move. In the aftermath of the North Korean heist, Sinbad has been sanctioned by the US government because he laundered millions of dollars in return for the money. 

According to court documents, law enforcement was able to freeze assets from seven transactions. However, the North Koreans were able to transfer a majority of the stolen funds to the Bitcoin blockchain to avoid being tracked, the documents say. The FBI recovered another .099 BTC, or approximately $6,270, from another exchange in a further investigation.
Read more »
North Korean
Andariel cyber attack Hacking Healthcare Mandiant Threat Intelligence North Korean

North Korean Hackers Expand Targets to Healthcare and Energy Sectors


 

A recent report by cybersecurity firm Mandiant reveals that Andariel, a North Korean hacking group, is broadening its scope of attacks to include the healthcare, energy, and financial sectors. This group, likely affiliated with the Democratic People's Republic of Korea Reconnaissance General Bureau, has previously targeted government institutions and critical infrastructure.

Andariel's cyber operations have become increasingly sophisticated over the years. According to Mandiant, the group is now being tracked as APT45 and continues to employ advanced tools and techniques to maximise impact while evading detection. These operations often aim to gather intelligence from government nuclear facilities, research institutes, and defence systems.

Michael Barnhart, Mandiant's principal analyst, highlighted that Andariel has been actively seeking blueprints for military advancements, emphasising the group's flexibility in targeting any entity to achieve its goals, including hospitals. Mandiant's report suggests that Andariel has been involved in ransomware development and deployment, operating under various codenames such as Onyx Sleet, Stonefly, and Silent Chollima. There are also links to the DPRK's notorious Lazarus hacking group.

North Korea is one of the few nations that supports for-profit hacking, using stolen funds to support the development of weapons of mass destruction and to bolster its economy. The report notes that Andariel directly targeted nuclear research facilities and power plants in 2019, including a facility in India. Following a suspected COVID-19 outbreak in North Korea in 2021, the group expanded its focus to the healthcare and pharmaceutical sectors.

Government and Defense Espionage

Initially, Andariel's activities centred on espionage campaigns against government agencies and defence industries. Over time, the group has shifted to include financially motivated operations, such as targeting the financial sector. Barnhart attributed many of North Korea's military advancements to Andariel's successful espionage efforts against governments and defence organisations globally.

Use of Artificial Intelligence

The report also references a January warning from the South Korean National Intelligence Service about North Korea's use of generative artificial intelligence technologies to conduct sophisticated cyberattacks and identify potential targets. This development accentuates the growing complexity and adaptability of North Korean hacking groups like Andariel.

Mandiant, a part of Google, has been working closely with multiple U.S. government agencies, including the FBI, to monitor Andariel's activities. This collaborative effort aims to mitigate the threat posed by the group and to protect critical infrastructure from its attacks.

The Mandiant report paints a concerning picture of Andariel's expanding operations and the increasing sophistication of its cyberattacks. As the group continues to evolve and adapt, it remains a substantial threat to various sectors worldwide, including healthcare, energy, and finance.


Read more »
Threat actors
Cyber Security Cybersecurity Deceptive npm packages malware installation North Korean social engineering campaign Software Developers Threat actors

Deceptive npm Packages Employed to Deceive Software Developers into Malware Installation

 

A persistent scheme aimed at software developers involves fraudulent npm packages disguised as job interview opportunities, with the intention of deploying a Python backdoor onto their systems.

Securonix, a cybersecurity company, has been monitoring this campaign, dubbed DEV#POPPER, which they attribute to North Korean threat actors. 

"During these fraudulent interviews, the developers are often asked to perform tasks that involve downloading and running software from sources that appear legitimate, such as GitHub," security researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov said. "The software contained a malicious Node JS payload that, once executed, compromised the developer's system."

Details of this campaign surfaced in late November 2023, when Palo Alto Networks Unit 42 revealed a series of activities known as Contagious Interview. Here, the threat actors masquerade as employers to entice developers into installing malware such as BeaverTail and InvisibleFerret during the interview process.

Subsequently, in February of the following year, Phylum, a software security firm, uncovered a collection of malicious npm packages on the registry. These packages delivered the same malware families to extract sensitive information from compromised developer systems.

It's important to distinguish Contagious Interview from Operation Dream Job, also linked to North Korea's Lazarus Group. The former targets developers primarily through fabricated identities on freelance job platforms, leading to the distribution of malware via developer tools and npm packages.

Operation Dream Job, on the other hand, extends its reach to various sectors like aerospace and cryptocurrency, disseminating malware-laden files disguised as job offers.

The attack sequence identified by Securonix begins with a GitHub-hosted ZIP archive, likely sent to the victim during the interview process. Within this archive lies an apparently harmless npm module housing a malicious JavaScript file, BeaverTail, which serves as an information thief and a loader for the Python backdoor, InvisibleFerret, retrieved from a remote server. This implant can gather system data, execute commands, enumerate files, and log keystrokes and clipboard activity.

This development underscores the continued refinement of cyber weapons by North Korean threat actors, as they update their tactics to evade detection and extract valuable data for financial gain.

Securonix researchers emphasize the importance of maintaining a security-conscious mindset, particularly during high-pressure situations like job interviews, where attackers exploit distraction and vulnerability.
Read more »
Subscribe to: Posts (Atom)