Microsoft takes down 50 domains operated by Thallium (APT37), a North Korean cyber-espionage group

guest · Dec 30, 2019

Microsoft takes down 50 domains operated by North Korean hackers
Microsoft takes control of 50 domains operated by Thallium (APT37), a North Korean cyber-espionage group
December 30, 2019
https://www.zdnet.com/article/microsoft-takes-down-50-domains-operated-by-north-korean-hackers/

Microsoft announced today that it successfully took down 50 web domains previously used by a North Korean government-backed hacking group.
The OS maker said the 50 domains were used to launch cyberattacks by a group the company has been tracking as Thallium (also known as APT37).

Microsoft said the Digital Crimes Unit (DCU) and the Microsoft Threat Intelligence Center (MSTIC) teams have been monitoring Thallium for months, tracking the group's activities, and mapping its infrastructure.
Thallium hackers would lure victims on these sites, steal their credentials, and then gain access to internal networks, from where they'd escalate their attacks even further.

"Based on victim information, the targets included government employees, think tanks, university staff members, members of organizations focused on world peace and human rights, and individuals that work on nuclear proliferation issues," said today Tom Burt, Corporate Vice President of Customer Security & Trust at Microsoft.
Click to expand...

Microsoft also used court orders to disrupt the operations of Barium, a Chinese government-backed hacking group, although details about these actions are a little bit light.
Click to expand...

Microsoft: Microsoft takes court action against fourth nation-state cybercrime group

Bloomberg Law: Microsoft Sues North Korea-Linked Hackers for Impersonation (1)

guest · Apr 1, 2020

North Korean hackers reboot espionage operations following December takedown
March 31, 2020
https://www.cyberscoop.com/apt37-geumseong121-north-korea-hackers-estsecurity/

Suspected North Korean hackers have been running a spearphishing email operation targeting people interested in North Korean refugees, according to new research from ESTsecurity, a South Korea-based security firm.

The cyber-espionage group, which ESTsecurity Security Response Center (ESRC) researchers attribute to a group known as Geumseong121, entices its victims into clicking links that look to be about North Korean refugees. But instead of delivering valuable information, the link points recipients to repositories that download malicious files, according to ESRC.
Click to expand...

The campaign, which ESRC has named “Operation Spy Cloud” since it relies on cloud services, shows the hacking group returning to operations following a setback in December when Microsoft seized 50 websites used by the group in spearphishing campaigns. The group is also widely known as APT37.
Following the takedown, the group is working to conceal its activities, according to ESRC.

The campaign includes both Windows- and Android-based components, according to ESRC.
It is not clear if Geumseong121 has been successful in exfiltrating data this month or what kinds of information or financial gain the group may ultimately be seeking at this time.
Click to expand...

Log in or Sign up

Microsoft takes down 50 domains operated by Thallium (APT37), a North Korean cyber-espionage group

guest Guest

guest Guest

Log in or Sign up

Microsoft takes down 50 domains operated by Thallium (APT37), a North Korean cyber-espionage group

guest Guest

guest Guest

Useful Searches