Thursday, March 28, 2024

Lazarus hacker Group Attack Defence Industries with custom-made Malware ThreatNeedle

Lazarus has now added the defence industry to its growing list of victims. Lazarus is a North Korean hacking group that has been active since 2009. The group has primarily been linked with ransomware campaigns, cyberespionage, and attacks against the cryptocurrency market. 

Researchers at Kaspersky were made aware of the attack on the defence industry when they had responded to an incident, and had discovered a backdoor that was subsequently named ThreatNeedle. The main goal of the backdoor is to extract confidential information and send it to the attackers by moving laterally through the infected networks.

Spearphishing is the method commonly used to deliver ThreatNeedle to the targets. The malicious Word documents are written to sound like urgent communication and updates regarding COVID-19.

ThreatNeedle is installed upon the document being opened, and this allows the attacker to take control of the infected machine.

Though this sounds like a regular malware that infects your system and steals data, it is nothing like it. It is more a malware on steroids than your run of the mill softwares. ThreatNeedle is capable of jumping between internet-facing office networks and restricted access operational technology (OT) networks where mission-critical hardware lives. 

The policies of the victim companies state that under no circumstance should data be able to be transferred between the two networks. However, administrators had the ability to connect to both solely for the purpose of maintenance.

“Lazarus was able to obtain control of administrator workstations and then set up a malicious gateway to attack the restricted network and to steal and extract confidential data from there. Not only were they able to overcome network segmentation, but they did extensive research to create highly personalized and effective spearphishing emails and built custom tools to extract the stolen information to a remote server. With industries still dealing with remote work and, thus, still more vulnerable, it is important that organizations take extra security precautions to safeguard against these types of advanced attacks, Kaspersky said.

Precautions to be taken:

  1. Extensive training to the staff regarding cybersecurity hygiene
  2. Teach and make the staff aware of the internal policies
  3.  Segmenting OT networks from IT networks
  4. Provide the latest threat intelligence to the security teams
  5. Have dedicated OT network security including but not limited to traffic monitoring, analysis, and threat detection.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles