Lazarus Group Targeting Defense Experts with Fake Interviews via Trojanized VNC Apps

The North Korea-connected Lazarus Group (aka Hidden Cobra or TEMP.Hermit) has been observed utilizing trojanized variations of Virtual Network Computing (VNC) applications as lures to goal the protection business and nuclear engineers as component of a lengthy-working campaign regarded as Procedure Desire Work.

“The menace actor tips job seekers on social media into opening malicious apps for pretend task interviews,” Kaspersky explained in its APT developments report for Q3 2023.

“To avoid detection by conduct-based security methods, this backdoored application operates discreetly, only activating when the user selects a server from the drop-down menu of the Trojanized VNC consumer.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

After introduced by the victim, the counterfeit application is created to retrieve further payloads, which include a identified Lazarus Group malware dubbed LPEClient, which will come fitted with capabilities to profile compromised hosts.

Also deployed by the adversary is an current variation of COPPERHEDGE, a backdoor recognized for running arbitrary commands, doing program reconnaissance, and exfiltrating info, as effectively as a bespoke malware specially intended for transmitting data files of desire to a distant server.

Targets of the newest marketing campaign comprise organizations that are instantly associated in protection production, together with radar systems, unmanned aerial motor vehicles (UAVs), military automobiles, ships, weaponry, and maritime corporations.

Procedure Aspiration Position refers to a series of attacks orchestrated by the North Korean hacking outfit in which potential targets are contacted by way of suspicious accounts by way of different platforms these types of as LinkedIn, Telegram, and WhatsApp under the pretext of supplying profitable career chances to trick them into setting up malware.

Late final month, ESET unveiled particulars of a Lazarus Team attack aimed at an unnamed aerospace business in Spain in which workforce of the firm had been approached by the menace actor posing as a recruiter for Meta on LinkedIn to deliver an implant named LightlessCan.

Lazarus Group is just a single of the several offensive plans originating from North Korea that have been connected to cyber espionage and financially motivated thefts.

Yet another popular hacking crew is APT37 (aka ScarCruft), which is section of the Ministry of Point out Security, unlike other danger activity clusters – i.e., APT43, Kimsuky, and Lazarus Team (and its sub-teams Andariel and BlueNoroff) – that are affiliated with the Reconnaissance Basic Bureau (RGB).

“Whilst different danger groups share tooling and code, North Korean danger action carries on to adapt and modify to make customized malware for distinctive platforms, such as Linux and macOS,” Google-owned Mandiant disclosed before this month, highlighting their evolution in conditions of adaptability and complexity.

ScarCruft, for every Kaspersky, qualified a buying and selling company linked to Russia and North Korea utilizing a novel phishing attack chain that culminated in the shipping of RokRAT (aka BlueLight) malware, underscoring ongoing attempts by the hermit kingdom to concentrate on Russia.

What’s extra, an additional recognizable shift is the infrastructure, tooling, and targeting overlaps in between different North Korean hacking outfits like Andariel, APT38, Lazarus Group, and APT43, muddying attribution efforts and pointing to a streamlining of adversarial activities.

This has also been accompanied by an “enhanced curiosity in the advancement of macOS malware to backdoor platforms of significant benefit targets in the cryptocurrency and the blockchain industries,” Mandiant stated.

Identified this article exciting? Adhere to us on Twitter  and LinkedIn to study extra unique content we article.