Lazarus Group Attack Identified After Operational Security Fail

A ransomware attack on targeted exploration, healthcare and strength sector corporations has been attributed to North Korea’s sophisticated persistent threat (APT) Lazarus Group just after the danger actor dedicated an “operational security blunder.”

Producing in an email to Infosecurity, WithSecure has mentioned that after investigating the attack, the crew joined it to a broader intelligence-gathering operation.

“While this was initially suspected to be an tried BianLian ransomware attack, the proof we collected quickly pointed in a unique route,” explained WithSecure senior risk intelligence researcher Sami Ruohonen.

“As we collected more proof, we turned far more confident that the attack was carried out by a team related to the North Korean govt.”

In accordance to the team, the new marketing campaign highlighted many “noteworthy developments” when compared to previous Lazarus Team action.

These incorporated the use of new infrastructure, such as the unique use of IP addresses with no area names, a modified model of the Dtrack backdoor and a novel variant of the Grease malware.

As for the operational security slip-up talked about by WithSecure, the crew stated the attacker utilised 1 out of a 1000 IP addresses belonging to North Korea that was noticed connecting to an attacker-managed web shell.

“In spite of the opsec fails, the actor demonstrated great tradecraft and still managed to carry out considered steps on meticulously selected endpoints,” warned Tim West, head of menace intelligence at WithSecure.

“Even with exact endpoint detection systems, organizations need to have to frequently think about how they answer to alerts, and also integrate targeted risk intelligence with common hunts to present better defense in depth, especially from able and adept adversaries.”

Attackers managed to reportedly exfiltrate 100GB of data, but WithSecure said they took no destructive action by the issue of disruption.

More information and facts about the attack and the malware made use of is offered in a full advisory released by WithSecure before nowadays.

The technological generate-up arrives weeks right after the FBI verified Lazarus Group was behind last year’s $100m theft from cryptocurrency business Harmony.

Some components of this report are sourced from:
www.infosecurity-magazine.com