North Korean hackers are targeting software developers and impersonating IT workers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-42793 | Authentication bypass in JetBrains TeamCity enables unauthenticated RCE JetBrains TeamCity Server, a widely used CI/CD build server, contains an authentication bypass vulnerability (CWE-288) that lets a remote, unauthenticated attacker gain administrative access without valid credentials. By sending crafted requests to the TeamCity server over the network, the attacker bypasses authentication and can then execute arbitrary code on the server via administrative and build features, achieving full remote code execution. An attacker gains control of the build server and, with it, access to source code, build artifacts, stored secrets and credentials, and a foothold for lateral movement or ransomware deployment. Any organization running an affected TeamCity Server is affected, especially instances reachable from the internet. Exploitation is confirmed in the wild: CISA added the flaw to its KEV catalog on 2023-10-04 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Upgrade TeamCity Server to 2023.05.4 or later per JetBrains' instructions, or apply vendor mitigations or discontinue use if patching is not possible (per the CISA KEV required action). Also take unpatched instances off the public internet, and hunt for signs of compromise such as unauthorized administrator accounts, unexpected changes in audit logs and build configurations, and stored secrets or tokens that may have been stolen, given known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largeTens of thousands of TeamCity Server deployments, of which several thousand are internet-exposed |
Full article690 words · extracted from helpnetsecurity.com · click to collapse
State-sponsored North Korean hackers have significantly intensified their focus on the IT sector in recent years, by infiltrating firms developing software and companies lookind for IT workers.
North Korean hackers targeting developers
Microsoft has outlined on Wednesday how North Korea-backed hacking groups Lazarus (Diamond Sleet) and Andariel (Onyx Sleet) have been exploiting a critical authentication bypass vulnerability (CVE-2023-42793) in JetBrains TeamCity server to breach target systems and establish persistent access to compromised hosts, to use them as a beachhead for more widespread compromise of companies’ systems and networks.
Diamond Sleet was observed using two attack paths: the first consisted in the deployment of ForestTiger backdoor while the second deployed payloads for DLL search-order hijacking attacks.
Onyx Sleet used a different attack path: After successfully exploiting the TeamCity vulnerability, the threat actor creates a user account (named krtbgt), runs system discovery commands and finally deploys a proxy tool named HazyLoad to establish persistent connection.
“In past operations, Diamond Sleet and other North Korean threat actors have successfully carried out software supply chain attacks by infiltrating build environments,” Microsoft noted.
North Korean state-sponsored hackers have been linked to a social engineering campaign targeting software developers through GitHub. By pretending to be a developer or a recruiter, the attacker managed to convince the victim to collaborate on a GitHub repository and ultimately download and execute malware on its device.
Judging by their leveraging of vulnerabilities in DevOps solutions such as TeamCity, it looks like their objectives and goals have remained constant.
North Korean IT workers: Potential malicious insiders
North Korean IT workers are also taking advantage of the shortage of skilled employees and have been contacting recruiters from companies offering software development and other IT jobs. By hiring these individuals, companies may end up with their trade secrets or funds stolen and their venture sabotaged from the inside.
On Tuesday, the FBI seized 17 website domains used by North Korean IT workers and made to look like they belong to legitimate, US-based IT services companies. The US authorities also seized approximately $1.5 million of revenue earned by those IT workers.
“As alleged in court documents, the Government of the Democratic People’s Republic of Korea (North Korea or DPRK) dispatched thousands of skilled IT workers to live abroad, primarily in China and Russia, with the aim of deceiving U.S. and other businesses worldwide into hiring them as freelance IT workers, in order to generate revenue for its weapons of mass destruction (WMD) programs,” says the US Justice Department.
“Through this scheme, which involves the use of pseudonymous email, social media, payment platform and online job site accounts, as well as false websites, proxy computers located in the United States and elsewhere, and witting and unwitting third parties, the IT workers generated millions of dollars a year on behalf of designated entities, such as the North Korean Ministry of Defense and others, directly involved in the DPRK’s UN-prohibited WMD programs. In some instances, the IT workers also infiltrated the computer networks of unwitting employers to steal information and maintain access for future hacking and extortion schemes.”
Guidance for the IT sector
The US Department of State, the US Department of the Treasury, and the Federal Bureau of Investigation issued a warning and advice last year to help companies that are looking for IT freelancers avoid hiring workers from North Korea.
That guidance has been updated on Wednesday to include additional “red flags” possibly identifying North Korean IT workers, as well additional due diligence measures companies should take to avoid hiring them.
To mitigate the risk of inadvertently hiring North Korean IT workers, companies are advised to request documentation of background checks from third-party staffing firms or outsourcing companies, verify the legitimacy of provided background check documentation, and ensure that financial information provided matches a legitimate bank. It’s also crucial to maintain detailed records of all interactions, implement strict security protocols, and consider geo-locating company laptops to ensure compliance with employee addresses.
Using reputable online freelance platforms with robust identity verification measures and avoiding direct recruitment through online IT competitions are also recommended to maintain the security and integrity of hiring processes.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/10/20/north-korean-hackers-it/