North Korean Group TA444 Shows 'Startup' Culture, Tries Numerous Infection Methods

guest · Jan 25, 2023

By Alessandro Mascellino @a_mascellino - January 25, 2023

A previously unknown, financially motivated North Korea state-sponsored threat actor has been observed testing several infection methods in the wild while adhering to a 'startup' culture mentality.
Click to expand...

The findings come from security researchers at Proofpoint, who called the group TA444 and said it has been active in its current form of targeting cryptocurrency exchanges since at least 2017.

According to an advisory published earlier today, the group then adopted an upstart mentality at the end of 2022.

“Equally as surprising as the variance in delivery methods is the lack of a consistent payload at the end of the delivery chains,” reads the advisory from senior threat researcher Greg Lesnewich and the Proofpoint threat research team.
“TA444 and related clusters are assessed to have stolen nearly $400m [...] worth of cryptocurrency and related assets in 2021. In 2022, the group surpassed that value in a single heist worth over $500m, gathering more than $1bn during 2022.”
Click to expand...

In terms of tools used during the attacks, Lesnewich wrote TA444 used “an impressive set of post-exploitation backdoors in its history.”

The list includes msoRAT, Cardinal, the Rantankba suite, Cheesetray and Dyepack, alongside passive backdoors, virtualized listeners and browser extensions to facilitate theft.

“While we may poke fun at its broad campaigns and ease of clustering, TA444 is an astute and capable adversary that is willing and able to defraud victims for hundreds of millions of dollars,” Proofpoint wrote.
Click to expand...

Proofpoint: TA444: The APT Startup Aimed at Acquisition (of Your Funds)

By Greg Lesnewich - January 25, 2023
Key Takeaways

TA444 is a North Korea state-sponsored threat actor that tested numerous infection methods in 2022 with varying degrees of success.

TA444 is a unicorn among state-aligned actors as its primary operations are financially motivated, and their infection chains are often a microcosm of the cybercrime threat landscape at large.

While TA444 has been active in its current form of targeting cryptocurrencies since at least 2017, the group has adopted an upstart mentality during the latter stages of 2022.

Click to expand...

Log in or Sign up

North Korean Group TA444 Shows 'Startup' Culture, Tries Numerous Infection Methods

guest Guest

Log in or Sign up

North Korean Group TA444 Shows 'Startup' Culture, Tries Numerous Infection Methods

guest Guest

Useful Searches