Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/16/2019
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

US Turning Up the Heat on North Korea's Cyber Threat Operations

Sanctions on North Korean nation-state hacking groups came amid reports of fresh malicious campaigns directed at US entities from the isolated nation.

The US government's move last Friday to slap sanctions on three North Korean cyber threat groups is being viewed by some security experts as a necessary but likely futile attempt to slow down state-sponsored hacking activity in that country.

The sanctions came amid reports of fresh threat activity targeted at US interests from North Korea. The US DHS and the FBI warned of new malware activity related to Hidden Cobra, a DDoS botnet previously linked to North Korea's intelligence apparatus. In another report, security vendor Prevailion said it had observed a recent expansion of a North Korean threat campaign dubbed 'Autumn Aperture' directed at US organizations in multiple industries.

The US Department of Treasury announced the sanctions against North Korea's Lazarus Group and two of its sub-groups Bluenoroff and Andarie. All three are accused of working for the Reconnaissance General Bureau (RGB) North Korea’s primary intelligence agency to support the country's missile and weapons programs.

Lazarus Group is best known for its involvement in the WannaCry 2.0 attacks of December 2017 and the crippling breach at Sony in 2014.  Security researchers believe Bluernoroff was established to earn money for the cash-strapped sanctions-hit North Korean government. The group has been linked to attacks on banks in Bangladesh, India, South Korea, Mexico and several other countries and is believed to have stolen tens of millions of dollars in these cyber heists. Andarie's mission is thought to be similar, though this group's attacks have focused on bankcard theft and ATM hacking.

In a statement announcing the sanctions, the Treasury Department described the three threat groups as being directly controlled by the North Korean government and being used to perpetuate the country's broader nuclear and military goals. The sanctions prohibit all dealings by US individuals and business with the three threat groups and any entities believed associated with them in a meaningful way. It also puts strictures on any properties or business deals the groups or their associates might have in the US.

The big question is whether the sanctions will have any deterrent impact considering the targeted groups are not based in the US nor are likely to have any meaningful assets or interests that can be seized here.

"Sanctions are, arguably ineffective and laughable," says Chris Roberts, chief security strategist at Attivo Networks.

US sanctions on North Korea for more than 25 years over its nuclear program have had little direct effect and it is likely the new ones against the three threat groups will do much to deter them, he says. Their business is breaking the law so merely telling them to stop will do little to change things on the ground Roberts notes. "Their tools, technologies and systems are in place, and anything they need they can readily get from the rest of the world with little difficulty."

John Hultquist, director of intelligence at FireEye, says over the past several years North Korea's cyber espionage apparatus has evolved into a significant state-run criminal enterprise. "North Korea has continuously improved their capability, especially with regards to their financially-motivated schemes, which often involve innovative tools and techniques," he says.

It's hard to judge the effectiveness of sanctions and indictments, which are two of the tools the US has attempted to leverage to alter the behavior of threat actors in other countries as well including in China, Russia, and Iran. Some, like China and Iran, have notably changed their behavior in the past, he notes. "But internal restructuring, or a warming relationship with the US may have caused the changes, rather than [sanctions]," he says.

Autumn Aperture Campaign

Meanwhile, Prevailion last week said it had observed a spike in activity related to Autumn Aperture, a cyber-espionage campaign targeting US organizations. The security vendor has linked the campaign with a moderate level of certainty to a North Korean advanced persistent threat group called Kimsuky or Smoke Screen.

Prevailion said its researchers have recently observed the threat actors behind the Autumn Aparture campaign using documents discussing North Korean nuclear deterrence and its nuclear submarine program as lures in malware-laden emails.

The documents that are being used are all legitimate documents written by industry experts. What the threat actors are doing is appending their malware to the documents and sending them out as attachments to targeted recipients—sometimes using obscure file formats such as Kodak FlashPix to evade detection.

Danny Adamitis, director of intelligence analysis at Prevailion, says with the latest campaign the threat actors have added functionality to check for the presence of various anti-virus products before downloading the secondary payload. "Prevailion assesses that the threat actor is a persistent threat that will continue to pose a threat to US based think tanks and their partners, particularly those involved in national security based upon historical targeting trends," Adamitis says.

The DHS and FBI last week also released alerts on malware activity tied to North Korea. The two agencies reported on an IP tunneling tool called ELECTRICFISH and a Trojan dubbed BADCALL that they described as being linked to the North Korean Hidden Cobra botnet.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Escaping Email: Unlocking Message Security for SMS, WhatsApp."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
WN2QU
50%
50%
WN2QU,
User Rank: Guru
9/17/2019 | 10:48:06 AM
Re: Utilize the ISP and other vendors to block countries
Not if they are using tools with Obfuscated Server Lists (OSL's) right? 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24619
PUBLISHED: 2020-09-22
In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker could offer a spoofed download resource.
CVE-2020-8887
PUBLISHED: 2020-09-22
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database contents via the page parameter in a page=login request to index.php (aka the server login page).
CVE-2020-7734
PUBLISHED: 2020-09-22
All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
CVE-2020-6564
PUBLISHED: 2020-09-21
Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.
CVE-2020-6565
PUBLISHED: 2020-09-21
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.