North Korea's Lazarus Hackers Found Targeting Russian Entities

guest · Feb 19, 2019

North Korea's Lazarus Hackers Found Targeting Russian Entities
February 19, 2019
https://www.securityweek.com/north-koreas-lazarus-hackers-found-targeting-russian-entities

Now, however, Check Point researchers have detected what they suspect is a Lazarus attack on Russian targets. "For the first time," it announces in a blog post today, "we were observing what seemed to be a North Korean coordinated attack against Russian entities."
Key to Check Point's belief that this is a Lazarus campaign is the final payload -- a versatile Lazarus backdoor that has been named KEYMARBLE by the US-CERT.

The infection flow used in this campaign comprises three primary steps. The first is an attached ZIP file containing a benign decoy PDF and a Word document containing malicious macros.
At some point during the campaign, however, the attackers decided to skip the second stage. They modified the malicious Word macros to download and execute the backdoor directly.

"A closer look at the compromised server shows an unconvincing website for the 'Information Department' of the 'South Oil Company'," writes Check Point. "The server is located in Iraq and hosted by EarthLink Ltd. Communications&Internet Services." The CAB file is disguised as a JPEG image.
Click to expand...

The real surprise in this campaign is that North Korea should now treat Russia as a target -- and there will be questions over whether this is a false flag attack from some other party.
Click to expand...

Minimalist · Mar 4, 2019

A server likely used by Lazarus Group offers clues to a broader espionage campaign

An analysis of a command-and-control server suspected of being used by North Korean hackers shows it was the centerpiece of a previously discovered global espionage campaign that is broader and longer-running than initially understood, security researchers with McAfee announced Sunday.
Click to expand...

https://www.cyberscoop.com/lazarus-group-mcafee-operation-sharpshooter/

Log in or Sign up

North Korea's Lazarus Hackers Found Targeting Russian Entities

guest Guest

Minimalist Registered Member

Log in or Sign up

North Korea's Lazarus Hackers Found Targeting Russian Entities

guest Guest

Minimalist Registered Member

Useful Searches