North Korean Gov Hackers Caught Rigging Legit Software

Threat hunters at Microsoft have intercepted a notorious North Korean government hacking group lacing legitimate open source software with custom malware capable of data theft, espionage, financial gain and network destruction.

The hackers, a sub-group of Lazarus that Microsoft calls ZINC, are weaponizing a wide range of open-source software including PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software installers in a new wave of malware attacks.

Redmond described the attackers as a “highly operational, destructive, and sophisticated nation-state activity group” and warned that its LinkedIn networking portal was also being abused to trawl for targets.  

In a report documenting the discovery, Microsoft said the hackers use LinkedIn to connect with and befriend employees in organizations across multiple industries including media, defense and aerospace, and IT services in the US, UK, India, and Russia. 

“Beginning in June 2022, ZINC employed traditional social engineering tactics by initially connecting with individuals on LinkedIn to establish a level of trust with their targets. Upon successful connection, ZINC encouraged continued communication over WhatsApp, which acted as the means of delivery for their malicious payloads,” Microsoft added. 

[ READ: North Korean Hackers Targeting Security Researchers With Zero-Days ]

The company is calling urgent attention to this threat because of the wide use and distribution of the booby-trapped legitimate software products. “[This] could pose a significant threat to individuals and organizations across multiple sectors and regions,” the company said.

In the report, Microsoft said the Lazarus sub-group has used spear-phishing as a primary tacticin the past but also managed strategic website compromises and social engineering across social media networks like LinkedIn and Twitter. 

At LinkedIn, the company’s threat prevention and defense team said it detected the North Koreans creating fake profiles claiming to be recruiters working at technology, defense, and media entertainment companies.  The goal was to lure targets away from LinkedIn and to the encrypted messaging app WhatsApp for the delivery of malware. 

The hackers primarily targeted engineers and technical support professionals working at media and information technology companies located in the U.S., U.K., and India. 

Once a connection with the target is established, the group pushes malicious versions of two SSH clients — PuTTY and KiTTY — that acted as the entry vector for the malware implant. Microsoft said the two utilities provide terminal emulator support for different networking protocols, making them attractive programs for individuals commonly targeted in these attacks.

Related: Google Warning: North Korean Gov Hackers Targeting Security Researchers

Related: North Korea Lazarus Hackers Blamed for $100 Million Horizon Bridge Heist

Related: North Korea APT Lazarus Targeting Chemical Sector

Related: U.S. Gov Blames North Korea Hackers for $600M Cryptocurrency Heist