Threat hunters at Microsoft have intercepted a notorious North Korean government hacking group lacing legitimate open source software with custom malware capable of data theft, espionage, financial gain and network destruction.
The hackers, a sub-group of Lazarus that Microsoft calls ZINC, are weaponizing a wide range of open-source software including PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software installers in a new wave of malware attacks.
Redmond described the attackers as a “highly operational, destructive, and sophisticated nation-state activity group” and warned that its LinkedIn networking portal was also being abused to trawl for targets.
In a report documenting the discovery, Microsoft said the hackers use LinkedIn to connect with and befriend employees in organizations across multiple industries including media, defense and aerospace, and IT services in the US, UK, India, and Russia.
“Beginning in June 2022, ZINC employed traditional social engineering tactics by initially connecting with individuals on LinkedIn to establish a level of trust with their targets. Upon successful connection, ZINC encouraged continued communication over WhatsApp, which acted as the means of delivery for their malicious payloads,” Microsoft added.
[ READ: North Korean Hackers Targeting Security Researchers With Zero-Days ]
The company is calling urgent attention to this threat because of the wide use and distribution of the booby-trapped legitimate software products. “[This] could pose a significant threat to individuals and organizations across multiple sectors and regions,” the company said.
In the report, Microsoft said the Lazarus sub-group has used spear-phishing as a primary tacticin the past but also managed strategic website compromises and social engineering across social media networks like LinkedIn and Twitter.
At LinkedIn, the company’s threat prevention and defense team said it detected the North Koreans creating fake profiles claiming to be recruiters working at technology, defense, and media entertainment companies. The goal was to lure targets away from LinkedIn and to the encrypted messaging app WhatsApp for the delivery of malware.
The hackers primarily targeted engineers and technical support professionals working at media and information technology companies located in the U.S., U.K., and India.
Once a connection with the target is established, the group pushes malicious versions of two SSH clients — PuTTY and KiTTY — that acted as the entry vector for the malware implant. Microsoft said the two utilities provide terminal emulator support for different networking protocols, making them attractive programs for individuals commonly targeted in these attacks.
Related: Google Warning: North Korean Gov Hackers Targeting Security Researchers
Related: North Korea Lazarus Hackers Blamed for $100 Million Horizon Bridge Heist
Related: North Korea APT Lazarus Targeting Chemical Sector
Related: U.S. Gov Blames North Korea Hackers for $600M Cryptocurrency Heist
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
- CrowdStrike to Acquire Application Intelligence Startup Bionic
- HiddenLayer Raises Hefty $50M Round for AI Security Tech
- Microsoft AI Researchers Expose 38TB of Data, Including Keys, Passwords and Internal Messages
- Extradited Russian Hacker Behind ‘NLBrute’ Malware Pleads Guilty
- Caesars Confirms Ransomware Hack, Stolen Loyalty Program Database
- AuthMind Scores $8.5M Seed Funding for ITDR Tech
- Zero-Day Summer: Microsoft Warns of Fresh New Software Exploits
Latest News
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- City of Dallas Details Ransomware Attack Impact, Costs
- In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
