Latest Report Uncovers Supply Chain Attacks by North Korean Hackers

Lazarus Group, the innovative persistent menace (APT) group attributed to the North Korean federal government, has been observed waging two independent offer chain attack campaigns as a suggests to gain a foothold into corporate networks and focus on a broad variety of downstream entities.

The hottest intelligence-gathering procedure involved the use of MATA malware framework as very well as backdoors dubbed BLINDINGCAN and COPPERHEDGE to attack the protection market, an IT asset monitoring alternative seller based mostly in Latvia, and a assume tank located in South Korea, according to a new Q3 2021 APT Tendencies report posted by Kaspersky.

In a single occasion, the supply-chain attack originated from an an infection chain that stemmed from respectable South Korean security program working a malicious payload, primary to the deployment of the BLINDINGCAN and COPPERHEDGE malware on the believe tank’s network in June 2021. The other attack on the Latvian firm in May is an “atypical sufferer” for Lazarus, the researchers stated.

It truly is not crystal clear if Lazarus tampered with the IT vendor’s software to distribute the implants or if the group abused the access to the company’s network to breach other clients. The Russian cybersecurity agency is tracking the marketing campaign below the DeathNote cluster.

That’s not all. In what appears to be a unique cyber-espionage campaign, the adversary has also been noticed leveraging the multi-system MATA malware framework to complete an array of malicious routines on contaminated machines. “The actor delivered a Trojanized version of an application identified to be applied by their target of alternative, representing a regarded characteristic of Lazarus,” the scientists observed.

In accordance to past results by Kaspersky, the MATA marketing campaign is able of striking Windows, Linux, and macOS working devices, with the attack infrastructure enabling the adversary to carry out a multi-staged an infection chain that culminates in the loading of extra plugins, which make it possible for access to a wealth of facts including files stored on the device, extract delicate database information as very well as inject arbitrary DLLs.

Further than Lazarus, a Chinese-talking APT danger actor, suspected to be HoneyMyte, was observed adopting the similar tactic, wherein a fingerprint scanner program installer package was modified to install the PlugX backdoor on a distribution server belonging to a govt agency in an unnamed state in South Asia. Kaspersky referred to the supply-chain incident as “SmudgeX.”

The advancement comes as cyber assaults aimed at the IT source chain have emerged as a top issue in the wake of the 2020 SolarWinds intrusion, highlighting the require to adopt rigid account security procedures and take preventive measures to secure company environments.

Identified this article appealing? Stick to THN on Facebook, Twitter  and LinkedIn to read a lot more exceptional material we article.

Some parts of this article are sourced from:
thehackernews.com