North Korea-linked trojan switches targets from banks to cryptocurrency enthusiasts

itman · Jan 24, 2018

Originally used by reputed North Korean hackers to attack the global banking sector, the Ratankba downloader trojan has been repurposed into a PowerShell-based variant that appears to be targeting small, non-financial organizations and individuals with an interest in cryptocurrency, an analysis shows.

In a Jan. 24 blog post, Trend Micro researchers CH Lei, Fyodor Yarochkin, Lenart Bermejo, Philippe Z. Lin, and Razor Huang report that the North Korea-linked APT group Lazarus has been infecting victims with the evolved version of Ratankba since June 2017, via phishing documents with cryptocurrency-themed lures.

The Trend Micro report strongly echoes a white paper https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf published in December 2017 by Proofpoint researchers, which refers to the PowerShell-based variant as PowerRatankba (which technically is two subvariants). "We believe that PowerRatankba was likely developed as a replacement in Lazarus Group's strictly financially motivated team's arsenal to fill the hole left by Ratankba's discovery and very public documentation earlier this year," the white paper explains.

In that paper, Proofpoint notes that the phishing campaign enticed readers to download malicious documents or visit fake web pages that supposedly provided downloads or updates for cryptocurrency applications. Either way, the victims would end up infected with the reconnaissance tool.
Click to expand...

https://www.scmagazine.com/north-ko...to-cryptocurrency-enthusiasts/article/739294/

Log in or Sign up

North Korea-linked trojan switches targets from banks to cryptocurrency enthusiasts

itman Registered Member

Log in or Sign up

North Korea-linked trojan switches targets from banks to cryptocurrency enthusiasts

itman Registered Member

Useful Searches