Lazarus Group Targeting Defense Experts with Fake Interviews via Trojanized VNC Apps

The North Korea-joined Lazarus Group (aka Concealed Cobra or TEMP.Hermit) has been noticed applying trojanized variations of Virtual Network Computing (VNC) apps as lures to target the defense business and nuclear engineers as aspect of a very long-running marketing campaign acknowledged as Procedure Dream Position.

“The menace actor methods work seekers on social media into opening malicious applications for bogus work interviews,” Kaspersky explained in its APT traits report for Q3 2023.

“To stay clear of detection by conduct-centered security alternatives, this backdoored software operates discreetly, only activating when the user selects a server from the fall-down menu of the Trojanized VNC client.”

The moment released by the target, the counterfeit app is created to retrieve additional payloads, which include a acknowledged Lazarus Group malware dubbed LPEClient, which arrives equipped with abilities to profile compromised hosts.

Also deployed by the adversary is an current version of COPPERHEDGE, a backdoor known for operating arbitrary commands, doing process reconnaissance, and exfiltrating knowledge, as well as a bespoke malware especially intended for transmitting documents of fascination to a distant server.

Targets of the newest campaign comprise corporations that are specifically included in protection production, together with radar methods, unmanned aerial vehicles (UAVs), army cars, ships, weaponry, and maritime corporations.

Operation Dream Task refers to a sequence of attacks orchestrated by the North Korean hacking outfit in which opportunity targets are contacted by way of suspicious accounts via several platforms this sort of as LinkedIn, Telegram, and WhatsApp less than the pretext of supplying beneficial work alternatives to trick them into installing malware.

Late past month, ESET disclosed information of a Lazarus Team attack aimed at an unnamed aerospace corporation in Spain in which personnel of the firm had been approached by the danger actor posing as a recruiter for Meta on LinkedIn to supply an implant named LightlessCan.

Lazarus Team is just 1 of the quite a few offensive courses originating from North Korea that have been linked to cyber espionage and financially inspired thefts.

A different outstanding hacking crew is APT37 (aka ScarCruft), which is section of the Ministry of Condition Security, in contrast to other danger action clusters – i.e., APT43, Kimsuky, and Lazarus Group (and its sub-groups Andariel and BlueNoroff) – that are affiliated with the Reconnaissance General Bureau (RGB).

“Even though distinctive menace teams share tooling and code, North Korean menace activity proceeds to adapt and alter to build customized malware for unique platforms, including Linux and macOS,” Google-owned Mandiant disclosed previously this thirty day period, highlighting their evolution in terms of adaptability and complexity.

ScarCruft, for each Kaspersky, qualified a investing organization connected to Russia and North Korea applying a novel phishing attack chain that culminated in the supply of RokRAT (aka BlueLight) malware, underscoring ongoing makes an attempt by the hermit kingdom to goal Russia.

What’s a lot more, another obvious shift is the infrastructure, tooling, and targeting overlaps concerning numerous North Korean hacking outfits like Andariel, APT38, Lazarus Team, and APT43, muddying attribution endeavours and pointing to a streamlining of adversarial things to do.

This has also been accompanied by an “elevated curiosity in the enhancement of macOS malware to backdoor platforms of higher price targets within just the cryptocurrency and the blockchain industries,” Mandiant stated.

Located this article intriguing? Comply with us on Twitter  and LinkedIn to go through additional special content we post.

Some parts of this article are sourced from:
thehackernews.com