New Evidence Cements Theory That North Korea is Behind Lazarus Group

itman · May 30, 2017

A 53-page report released today by Group-IB, a Russian cyber-security vendor, contains new evidence that cements the theory that the North Korean government is behind the Lazarus Group, a cyber-espionage outfit.

Researchers find main C&C servers used to coordinate attacks

According to Group-IB specialists, following the publication of the Operation Blockbuster report in the winter of 2016, the group was forced to scrap most of its tools and tactics.

Group-IB says it observed new hacking tools that used very complex multi-stage deployment techniques, along with a three-layer C&C server infrastructure, used to control this new malware, used solely in the SWIFT attacks.

Following months of digging through evidence, Group-IB claims it managed to find the two IP addresses at the top of this C&C server infrastructure.

The first is 210.52.109.22, which they say is assigned to a company in China named China Netcom. However, Group-IB claims it heard from sources that the set of IPs 210.52.109.0/24 was assigned to North Korea in the meantime. This information is currently unconfirmed.

Nonetheless, the location of the second C&C server IP address speaks volumes.

175.45.178.222 refers to a North Korean Internet service provider. The Whois service indicates that this address is allocated to the Potonggang District, perhaps coincidentally, where the National Defence Commission is located — the highest military body in North Korea.

Lazarus Group is masquerading as Russian hackers

The Group-IB report published today also confirms a report by BAE Systems from February, in which BAE experts revealed that the malware used in the SWIFT attacks during the past year contained false flags trying to blame the hacks on Russian hackers.

Just like BAE, Group-IB experts also found Russian words that were not used correctly and other clues that the Lazarus Group was trying to pass as Russian hackers. These include Flash and Silverlight exploits borrowed from the sets of exploits created by Russian-speaking hackers, and the usage of Enigma Protector, an anti-tampering system for executable files developed by a Russian company.

Experts found these clues despite sustained efforts from the Lazarus Group to create new malware strains to replace previously exposed malware. A previous BAE Systems report also linked this new malware used in the Swift bank attacks to previous Lazarus Group operations.

Details, modus operandi, and IOCs about the new Lazarus Group malware are available in Group-IB's Lazarus Arisen report. Last week, Symantec also published a summary of past Lazarus Group attacks.

Previous reports from the intelligence community have said that Bureau 121, a division of the Reconnaissance General Bureau, a North Korean intelligence agency part of the National Defence Commission, is actually Lazarus Group.
Click to expand...

https://www.bleepingcomputer.com/ne...ory-that-north-korea-is-behind-lazarus-group/

hawki · Jun 1, 2017

FWIW:

"Who's to blame for that cyberattack? Here's why nobody's really sure

Nation state or script kiddie? Pointing blame after a cyberattack was never easy, but now it's almost impossible..."

http://www.zdnet.com/article/nation...pt-kiddie-why-is-pointing-blame-so-difficult/

Log in or Sign up

New Evidence Cements Theory That North Korea is Behind Lazarus Group

itman Registered Member

hawki Registered Member

Log in or Sign up

New Evidence Cements Theory That North Korea is Behind Lazarus Group

itman Registered Member

hawki Registered Member

Useful Searches