Pyongyang hackers eye more coronavirus research, Kaspersky says

North Korea's COVID-19 hacking spree continues.

North Korean-government linked hackers are continuing their effort to break into entities working on coronavirus-related research.

In their latest antics, the hackers, suspected to be part of the government-backed hacking team known as Lazarus Group, have zeroed in on a pharmaceutical company and a government health-focused entity, according to Kaspersky research published Wednesday. Kaspersky attribute the hacking spree to Lazarus Group with “high confidence.”

Kaspersky did not identify the targeted entities and did not reveal where the pharmaceutical company or the government entity are located.

The activity appears to be just the latest of Pyongyang’s campaigns targeting coronavirus-related work. In recent months, North Korean hackers have reportedly gone after Johnson & Johnson and Novavax, both U.S.-based firms working on potential coronavirus vaccines. North Korean hackers have also reportedly targeted three South Korean-based firms and U.K.-based AstraZeneca. 

The hackers used malware known as “Bookcode” to target the unidentified pharmaceutical entity in their latest hacking spree, according to Kaspersky. Bookcode is used exclusively by Lazarus Group, according to previous Kaspersky research. This campaign, which Lazarus Group launched in late September, enabled the hackers to run some post-exploitation code against the target. The malware is also capable of sharing victims’ passwords with the hackers.

Kaspersky notes that the targeted entity is authorized to produce and distribute a coronavirus vaccine. Pfizer and BioNTech’s vaccine is currently approved under emergency protocol for distribution in the U.S., as well as in Canada, the U.K. and the European Union. Moderna’s vaccine has also been approved under emergency conditions for distribution in the U.S. There are also vaccines available for distribution in China and Russia.

In a separate campaign targeting the unidentified health ministry, which Kaspersky researchers say took place in October, the hackers installed malware called wAgent on two Windows servers. The hackers were able to use wAgent to retrieve other malicious payloads from an attacker-controlled server, the researchers said.

Early on in the pandemic, hackers began targeted government agencies working on COVID-19 response. In March, for instance, apparent hackers began scanning the networks of the U.S. Department of Health and Human Services at an increasing rate in what appeared to be a failed denial-of-service attack.

More recently, the European Medicines Agency, which has been working on rolling out vaccines from Pfizer-BioNTech and Moderna, said this month it had been targeted by hackers.

North Korea’s interest in COVID-19 response and research is not unique — hackers around the globe, including hackers linked with the Chinese and Russian governments, have been targeting coronavirus-related research and entities, according to government analysts.

The FBI has said that its primary concern with hackers targeting coronavirus-related work is if they are successful in causing any sort of disruption that could reduce the efficacy or safety of vaccines.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure