North Korea-linked hackers target US energy sector by exploiting VMware Horizon

Shutterstock

The North Korean point out-sponsored APT Lazarus Team has been determined as conducting a new destructive campaign that exploits vulnerabilities in VMware Horizon to get access to organisations in the electrical power sector.

As observed and thorough by Cisco Talos Intelligence, the attackers have targeted electricity companies from the US and somewhere else all over the planet, which includes Canada and Japan.

The group’s purpose is to use VMware’s vulnerabilities to infiltrate these organizations and establish lengthy-phrase obtain, just before shifting laterally across the enterprises to exfiltrate information of fascination back to North Korea.

Once the initial foothold is recognized, the attackers deploy the group’s tailor made malware implants VSingle and YamaBot, as properly as a previously unknown implant that Talos has named “MagicRAT”.

“The most important target of these attacks was possible to set up extended-phrase entry into sufferer networks to carry out espionage functions in help of North Korean government goals,” Cisco Talos claimed in a site submit.

“This activity aligns with historic Lazarus intrusions concentrating on critical infrastructure and strength companies to build lengthy-time period access to siphon off proprietary intellectual property.”

The cybersecurity agency reported the original attack vector was the exploitation of the Log4j vulnerability on uncovered VMware servers, which led to the obtain of their toolkit from web servers.

This, alongside with quite a few other facets, matched similar attacks carried out and observed in other attacks earlier this 12 months. The IP handle employed as a hosting system for the destructive tools was also located to be an overlap.

“Although the identical ways have been utilized in the two attacks, the resulting malware implants deployed have been distinctive from one an additional, indicating the vast variety of implants out there at the disposal of Lazarus,” Talos additional.

MagicRAT

In a abide by-up put up, Cisco Talo detailed the freshly-found Distant Access Trojan (RAT) it has dubbed “MagicRAT”, which it believes with “moderate to significant confidence” was deployed by Lazarus as part of these attacks on energy organizations.

Described as “relatively simple” in terms of capability, the RAT was programmed in C++ and constructed with recourse to the Qt framework, with the sole intention of creating human examination more difficult and automated detection fewer probably, Talos stated.

Evidence was also discovered to propose that, once MagicRAT is deployed on infected techniques, it then launches further payloads these as customized-developed port scanners, the business included. The RAT’s C2 infrastructure was also applied to host more recent variants of known Lazarus implants these types of as TigerRAT.

“The discovery of MagicRAT in the wild is an indication of Lazarus’ motivations to quickly develop new, bespoke malware to use alongside with their beforehand known malware these kinds of as TigerRAT to concentrate on organisations throughout the world,” Cisco Talos mentioned.

Some parts of this post are sourced from:
www.itpro.co.uk