Lazarus APT group, infamous for targeting the defense industry, now abuses Windows Update Client to spread malware. It was recently observed masquerading as Lockheed Martin in spear-phishing campaigns. For the first time in this...
The group once again dangled fake job opportunities at engineers in a spear-phishing campaign that used Windows Update as a living-off-the-land technique and GitHub as a C2. click here to read full Article Read...
TinyBanker/Tinba, Dridex, Anubis, Trickbot, and Kronos Trojans are commonly associated with financial service attacks, and some of these malware may also be used to execute second-stage ransomware. click here to read full Article Read...
In June 2021, Kaspersky ICS CERT experts identified malware whose loader has some similarities to the Manuscrypt malware, which is part of the Lazarus APT group’s arsenal. In 2020, the group used Manuscrypt in...
The North Korean state-sponsored hacking group is again trying to hack security researchers, this time with a trojanized pirated version of the popular IDA Pro reverse engineering application. click here to read full Article...
The infamous North Korea state-sponsored Lazarus APT was recently found targeting IT supply chains. Now, the group has been discovered attempting to hack security researchers again. click here to read full Article Read more...
For more than four years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research...
Kaspersky revealed two separate supply chain attacks by Lazarus Group aimed at an IT asset monitoring solution vendor, a South Korean think tank, and the defense industry. Hackers use a Racket downloader (signed with...
The notorious Lazarus advanced persistent threat (APT) group has been identified as the cybergang behind a campaign spreading malicious documents to job-seeking engineers. click here to read full Article Read more on computer hacking...
Executive summary In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. While we were doing our research...
Proofpoint reported about a new DDoS extortion activity by a threat actor group called Fancy Lazarus. It was observed extorting funds from various organizations operating in the energy, financial, and manufacturing sectors, among others....
Researchers gathered evidence from multiple attacks on cryptocurrency exchanges attributed to a threat actor named CryptoCore and established a strong link to the North Korean Lazarus APT group. click here to read full Article...
While the North Korean threat actor had targeted e-commerce shops in 2019 and 2020 to steal payment card information, the attackers aimed to steal cryptocurrency, as well. click here to read full Article Read...
A spearphishing attack operated by a North Korean threat actor targeting its southern counterpart has been found to conceal its malicious code within a bitmap (.BMP) image file to drop a RAT. click here...
Hackers with apparent ties to North Korea that hit e-commerce shops in 2019 and 2020 to steal payment card data also tested functionality for stealing cryptocurrency, according to Group-IB. click here to read full...
ESET researchers have discovered a previously undocumented Lazarus malware backdoor used to attack a freight logistics company in South Africa, which they have dubbed Vyveva. click here to read full Article Read more on...
