North Korean Hackers Targeting Healthcare with Ransomware to Fund its Operations

State-backed hackers from North Korea are conducting ransomware attacks versus health care and critical infrastructure services to fund illicit routines, U.S. and South Korean cybersecurity and intelligence companies warned in a joint advisory.

The assaults, which need cryptocurrency ransoms in exchange for recovering obtain to encrypted documents, are created to guidance North Korea’s countrywide-stage priorities and aims.

This incorporates “cyber operations focusing on the United States and South Korea governments — precise targets include Section of Defense Info Networks and Defense Industrial Base member networks,” the authorities claimed.

Threat actors with North Korea have been linked to espionage, economical theft, and cryptojacking functions for years, like the notorious WannaCry ransomware attacks of 2017 that infected hundreds of 1000’s of machines positioned in about 150 nations around the world.

Because then, North Korean nation-condition crews have dabbled in several ransomware strains this sort of as VHD, Maui, and H0lyGh0st to create a continual stream of unlawful revenues for the sanctions-strike regime.

Besides procuring its infrastructure by means of cryptocurrency generated by its legal functions, the adversary is recognized to operate underneath third-social gathering overseas affiliate identities to conceal their involvement.

Attack chains mounted by the hacking crew entail the exploitation of recognised security flaws in Apache Log4j, SonicWall, and TerraMaster NAS appliances (e.g., CVE 2021-44228, CVE-2021-20038, and CVE-2022-24990) to obtain initial entry, following it up by reconnaissance, lateral motion, and ransomware deployment.

In addition to applying privately developed ransomware, the actors have been observed leveraging off-the-shelf resources like BitLocker, DeadBolt, ech0raix, Jigsaw, and YourRansom for encrypting documents, not to point out even impersonating other ransomware groups this kind of as REvil.

As mitigations, the organizations recommend organizations to implement the basic principle of the very least privilege, disable avoidable network machine administration interfaces, implement multi-layer network segmentation, involve phishing-resistant authentication controls, and keep periodic details backups.

The notify comes as a new report from the United Nations discovered that North Korean hackers stole report-breaking virtual property approximated to be value involving $630 million and a lot more than $1 billion in 2022.

The report, found by the Involved Press, explained the risk actors made use of ever more refined procedures to gain accessibility to digital networks concerned in cyberfinance, and to steal data from governments, companies, and folks that could be helpful in North Korea’s nuclear and ballistic missile courses.

It more named out Kimsuky, Lazarus Team, and Andariel, which are all component of the Reconnaissance Standard Bureau (RGB), for continuing to focus on victims with the target of creating profits and soliciting info of worth to the hermit kingdom.

Discovered this write-up attention-grabbing? Comply with us on Twitter  and LinkedIn to browse extra unique material we post.

Some parts of this article are sourced from:
thehackernews.com