US Warns Critical Sectors Against North Korean Ransomware Attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) issued a new Cybersecurity Advisory (CSA) on Thursday warning critical infrastructure sector entities in opposition to ongoing North Korean state-sponsored ransomware activity.

Section of the #StopRansomware marketing campaign, the new advisory is a end result of a collaboration among CISA, the Nationwide Security Agency (NSA), the Federal Bureau of Investigation (FBI), the Office of Wellness and Human Services (HHS), the Republic of Korea (ROK) National Intelligence Provider (NIS) and the ROK Defense Security Agency (DSA).

The technological create-up builds on a July advisory, which offered an overview of Democratic People’s Republic of Korea (DPRK) point out-sponsored ransomware teams.

The most up-to-date iteration of the doc is now analyzing exercise by the Maui and H0lyGh0st teams. Observable methods, approaches and methods (TTPs) outlined in the CISA advisory contain the acquisition of infrastructure, these as domains, personas and accounts, as very well as the obfuscation of identities.

These DPRK threat actors reportedly obtained virtual non-public networks (VPNs) and digital personal servers (VPSs) or 3rd-state IP addresses to cover their area. They utilised a variety of exploits of frequent vulnerabilities to obtain accessibility and escalate network privileges. These involve CVE 2021-44228, CVE-2021-20038 and CVE-2022-24990.

Immediately after obtaining initial access, these DPRK cyber actors were noticed utilizing staged payloads with custom made malware to perform reconnaissance things to do and execute shell instructions, among the other tactics. Privately formulated ransomware has been deployed continually throughout these campaigns, with ransom demands established in Bitcoin.

To safeguard in opposition to these threats, the CISA advisory advocates many mitigations, these types of as restricting accessibility to info by authenticating and encrypting connections, using concepts of the very least privilege in accounts and making multi-layer defenses for networks and belongings.

In accordance to Roman Arutyunov, co-founder and SVP of items at Xage Security, critical infrastructure providers need to embrace these adjustments regardless of the specialized troubles connected with this sort of implementations.

“I do acknowledge that fears exist when it comes to the problem of making security architecture modifications, but there are tools out there to clean the transition and improve security and functions at the same time,” Arutyunov advised Infosecurity in an email.

“Ultimately, extra threats will come, so it’s clever to start out the procedure now.”

The CISA advisory will come weeks right after Proofpoint scientists shed light-weight on a new DPRK cyber actor known as TA444.

Some parts of this article are sourced from:
www.infosecurity-magazine.com