Lazarus Group Attack Identified After Operational Security Fail

A ransomware attack on qualified analysis, professional medical and power sector organizations has been attributed to North Korea’s sophisticated persistent menace (APT) Lazarus Group immediately after the risk actor fully commited an “operational security oversight.”

Crafting in an email to Infosecurity, WithSecure has claimed that soon after investigating the attack, the crew connected it to a broader intelligence-accumulating operation.

“Even though this was to begin with suspected to be an tried BianLian ransomware attack, the evidence we gathered immediately pointed in a different course,” discussed WithSecure senior risk intelligence researcher Sami Ruohonen.

“As we collected a lot more proof, we grew to become much more assured that the attack was conducted by a team connected to the North Korean government.”

According to the team, the new marketing campaign highlighted various “noteworthy developments” in contrast to previous Lazarus Team exercise.

These incorporated the use of new infrastructure, this kind of as the unique use of IP addresses with no domain names, a modified version of the Dtrack backdoor and a novel variant of the Grease malware.

As for the operational security miscalculation pointed out by WithSecure, the crew reported the attacker utilized a single out of a 1000 IP addresses belonging to North Korea that was noticed connecting to an attacker-managed web shell.

“In spite of the opsec fails, the actor demonstrated good tradecraft and nevertheless managed to carry out regarded as actions on thoroughly chosen endpoints,” warned Tim West, head of menace intelligence at WithSecure.

“Even with correct endpoint detection systems, corporations want to frequently take into account how they answer to alerts, and also combine targeted risk intelligence with common hunts to supply better protection in depth, specifically towards able and adept adversaries.”

Attackers managed to reportedly exfiltrate 100GB of details, but WithSecure claimed they took no destructive action by the stage of disruption.

A lot more data about the attack and the malware utilised is available in a full advisory released by WithSecure previously currently.

The complex create-up comes months just after the FBI verified Lazarus Group was behind very last year’s $100m theft from cryptocurrency firm Harmony.

Some parts of this article are sourced from:
www.infosecurity-magazine.com