Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Korean hackers. Show all posts
Korean hackers
Advanced Social Engineering cryptocurrency attacks cryptocurrency theft Cyber Security data security Hacker attack Korean hackers

North Korean Hackers Target 1,640 Companies Across 57 Countries, Researcher Finds

 

North Korean hackers have been targeting the infrastructure and cryptocurrency wallets worldwide. Greek security expert Vangelis Stykas identified 1,640 organizations across 57 countries hit by the attack. His investigation, which gained unauthorized access to the networks run by North Korean hackers, took about 22 months. 

At the Black Hat conference in Las Vegas, Stykas spoke about the attacks, mentioning that around 700 to 800 companies out of 1,640 had fallen victim to “truly malicious” intrusion. In some cases, the servers and AWS accounts were compromised at the root level by state-sponsored groups. Stykas did not disclose how he managed to infiltrate the North Korean hacking groups. He noted that his computer might have been infected with the group’s malware since their computers were infected. 

The security analyst had access to Slack and Discord accounts controlled by the hackers and gathered five terabytes of data. Lazarus Group complex, one of the North Korean state-sponsored hacking groups, has been using encrypted messaging services like Telegram and Signal to coordinate crypto heists and money laundering schemes. According to the report by Chainalysis, which monitors illicit crypto transactions, North Korean hackers have generated more than $2.02 billion in 2025, a 51 percent increase from the previous year. 

Their cumulative cryptocurrency theft since 2017 reached about $6.75 billion in value through crypto heists. Moreover, 76% of crypto heists worldwide occurred in the first four months of 2026, with North Korean-sponsored groups being the masterminds behind these crimes. The groups are also changing their tactics, shifting from compromised encryption keys to social engineering to infiltrate new crypto exchanges. Stykas added that toward the end of 2024, attackers primarily used social engineering to convince victims to install malicious software on their computers by posing as recruiters offering high-paying IT jobs. 

The software would allow hackers to access the victims’ computers under the guise of testing their skills. The list of companies targeted by North Korean hackers includes Chinese smartphone manufacturer Oppo, Boston’s Children Hospital, tech firms in Japan, Italy’s judicial organizations, and Belgium’s Flemish government. Several of the organizations, including Flemish government agencies and Boston’s Children Hospital, noted that the breach originated from third-party contractors, and the damage was minimal. 

Moreover, Stykas added that many of his warnings went unheeded by the organizations that had fallen victim to the attacks. His research revealed that many organizations are using third-party contractors and service providers that operate as subcontractors for different firms. A single compromised third-party organization can lead to a security breach of multiple organizations. 

North Korean hackers not only target crypto wallets but also use their IT expertise to infiltrate organizations and exfiltrate data. Experts believe that North Korea continues to fund its nuclear program from the proceeds of these crimes.  Moreover, hackers pose as legitimate IT professionals offering their services on job boards, eventually getting hired and transferring the earnings to North Korean banks. Authorities believe North Korean hackers’ activities are designed to circumvent sanctions imposed on the country. 

According to experts, the infiltration of crypto exchanges, technology companies, and financial organizations will enable North Korea to bypass sanctions while funding its military expansion and nuclear program. Andariel hacker group, which targets defense and nuclear-related organizations, was dismantled by security agencies in 2024.
Read more »
TARK#MULE Cyber Attack Campaign
APT37 cyber attack Cyber Attacks Cyber campaign Korean hackers TARK#MULE Cyber Attack Campaign

TARK#MULE Cyber Attack Campaign Tricking Koreans with U.S. Military-Themed Documents

A relentless cyber attack campaign has been launched, specifically targeting Korean-speaking individuals. The attackers are employing deceptive tactics, using U.S. Military-themed document lures to deceive unsuspecting victims into executing malware on their compromised systems. 

Following the incident, Securonix – a cybersecurity firm – dubbed this sophisticated cyber attack campaign as 'STARK#MULE.' The full extent of the attacks remains undisclosed, leaving uncertainty about the number of victims impacted.  As of now, it remains unclear whether any of the attack attempts have resulted in successful compromises. The situation calls for continued monitoring and vigilance to safeguard potential targets from threats posed by the ongoing campaign. 

According to the report, “these types of attacks are on par with past attacks stemming from typical North Korean groups such as APT37 as South Korea has historically been a primary target of the group, especially its government officials”.  APT37, also known as Nickel Foxcroft, Reaper, Ricochet Chollima, and ScarCruft, is a nation-state actor affiliated with North Korea. Its primary focus lies exclusively on targeting entities within South Korea, particularly those involved in reporting on North Korea and supporting defectors. 

The group has utilized social engineering techniques to initiate phishing attacks, thereby delivering malicious payloads like RokRat onto targeted networks. However, recent developments indicate that adversaries have broadened their offensive capabilities, incorporating various malware families into their tactics. Among the new additions is a Go-based backdoor named AblyGo. 

The campaign exhibits a distinctive strategy, leveraging compromised Korean e-commerce websites for both staging malicious payloads and establishing command-and-control (C2) operations. This clever maneuver aims to evade detection by security solutions installed on targeted systems. 

By utilizing legitimate platforms, the threat actors attempt to fly under the radar and maintain a cloak of stealth during their activities. This innovative approach poses a new challenge for cybersecurity experts in their efforts to protect against evolving threats and reinforces the need for enhanced security measures across digital landscapes. 

As per the information, APT37 has adopted a new tactic, utilizing CHM files in phishing emails to impersonate security communications from financial institutions and insurance companies. The objective is to deceive victims and prompt them to open these malicious files, thereby deploying information-stealing malware and other harmful binaries onto their systems. This observation was made by the AhnLab Security Emergency Response Center (ASEC), shedding light on the threat actor's evolving techniques. 

Using CHM files in disguise poses a significant concern for security teams as they strive to mitigate the risks of cyber-attacks and safeguard sensitive data from sophisticated threat actors. APT37 stands among several North Korean state-sponsored groups that have garnered attention for executing sophisticated cyber attacks aimed at achieving financial theft, as evident from the recent attacks on Alphapo and CoinsPaid. 

Moreover, the group's activities also revolve around gathering intelligence to further the regime's political and national security objectives. This dual focus on financial gains and intelligence acquisition underscores the significance of countering APT37's actions to protect the interests of targeted organizations and safeguard critical national security information from falling into the wrong hands.
Read more »
Subscribe to: Posts (Atom)