Attacks/Breaches

12/15/2017
12:56 PM
50%
50%

Lazarus Group Targets Bitcoin Company

The cybercrime group blamed for attacks on the SWIFT financial network launches a spearphishing campaign to steal employee credentials at a London cryptocurrency company.

Security researchers believe the Lazarus Group - believed to be responsible for the massive 2014 breach at Sony and the 2016 attacks on the SWIFT network - is now targeting employees of a London cryptocurrency company with a phishing campaign, in an effort to gain remote control of employees' devices, Reuters reports.

Researchers at Secureworks Counter Threat Unit discovered the campaign, which aims to lure employees to click on a link for a chief financial officer job opening. The link then downloads malware onto users' devices and gives attackers remote control of the device.

The technology used in this particular campaign is similar to ones used in other campaigns tied to Lazarus, which is linked to the North Korean government, Reuters reports.

Secureworks, which came across the Lazarus phishing campaign as recently as last month, believes the group's efforts are still ongoing, Reuters notes.

Read more about the phishing campaign here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Number of Retailers Impacted by Breaches Doubles
Ericka Chickowski, Contributing Writer, Dark Reading,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1503
PUBLISHED: 2018-07-23
IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed headers that could cause messages to no longer be transmitted via the affected channel. IBM X-Force ID: 141339.
CVE-2018-1513
PUBLISHED: 2018-07-23
IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB...
CVE-2018-6677
PUBLISHED: 2018-07-23
Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges via unspecified vectors.
CVE-2018-6678
PUBLISHED: 2018-07-23
Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors.
CVE-2018-14512
PUBLISHED: 2018-07-23
An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[nickname] parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail ...