Threat hunters at Microsoft have intercepted a notorious North Korean government hacking group lacing legitimate open source software with custom malware capable of data theft, espionage, financial gain and network destruction.
The hackers, a sub-group of Lazarus that Microsoft calls ZINC, are weaponizing a wide range of open-source software including PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software installers in a new wave of malware attacks.
Redmond described the attackers as a “highly operational, destructive, and sophisticated nation-state activity group” and warned that its LinkedIn networking portal was also being abused to trawl for targets.
In a report documenting the discovery, Microsoft said the hackers use LinkedIn to connect with and befriend employees in organizations across multiple industries including media, defense and aerospace, and IT services in the US, UK, India, and Russia.
“Beginning in June 2022, ZINC employed traditional social engineering tactics by initially connecting with individuals on LinkedIn to establish a level of trust with their targets. Upon successful connection, ZINC encouraged continued communication over WhatsApp, which acted as the means of delivery for their malicious payloads,” Microsoft added.
[ READ: North Korean Hackers Targeting Security Researchers With Zero-Days ]
The company is calling urgent attention to this threat because of the wide use and distribution of the booby-trapped legitimate software products. “[This] could pose a significant threat to individuals and organizations across multiple sectors and regions,” the company said.
In the report, Microsoft said the Lazarus sub-group has used spear-phishing as a primary tacticin the past but also managed strategic website compromises and social engineering across social media networks like LinkedIn and Twitter.
At LinkedIn, the company’s threat prevention and defense team said it detected the North Koreans creating fake profiles claiming to be recruiters working at technology, defense, and media entertainment companies. The goal was to lure targets away from LinkedIn and to the encrypted messaging app WhatsApp for the delivery of malware.
The hackers primarily targeted engineers and technical support professionals working at media and information technology companies located in the U.S., U.K., and India.
Once a connection with the target is established, the group pushes malicious versions of two SSH clients — PuTTY and KiTTY — that acted as the entry vector for the malware implant. Microsoft said the two utilities provide terminal emulator support for different networking protocols, making them attractive programs for individuals commonly targeted in these attacks.
Related: Google Warning: North Korean Gov Hackers Targeting Security Researchers
Related: North Korea Lazarus Hackers Blamed for $100 Million Horizon Bridge Heist
Related: North Korea APT Lazarus Targeting Chemical Sector
Related: U.S. Gov Blames North Korea Hackers for $600M Cryptocurrency Heist

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Microsoft Catches Chinese .Gov Hackers Targeting US Critical Infrastructure
- Researchers Spot APTs Targeting Small Business MSPs
- Mikrotik Belatedly Patches RouterOS Flaw Exploited at Pwn2Own
- Red Hat Pushes New Tools to Secure Software Supply Chain
- Investors Make $6M Bet on Manifest for SBOM Management Technology
- Entro Raises $6M to Tackle Secrets Sprawl
Latest News
- Insider Q&A: Artificial Intelligence and Cybersecurity In Military Tech
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
