As Trump promises 'fire and fury,' North Korean hackers target U.S. defense contractors

Hackers linked to a North Korean cyber espionage group — best known for a global ransomware attack dubbed "WannaCry" — are now actively targeting U.S. defense contractors.

Hackers linked to a North Korean cyber-espionage group — best known for the global ransomware attack dubbed WannaCry — are now actively targeting U.S. defense contractors as part of an apparent, ongoing intelligence gathering operation, according to new research published by U.S. cybersecurity firm Palo Alto Networks.

The findings come at time of heightened tension between the U.S. and North Korea while the leaders of each nation have exchanged threats of nuclear warfare.

North Korea is a known and well-established adversary of the U.S. in cyberspace. The group responsible for both WannaCry and this newly uncovered intelligence operation is codenamed Lazarus Group by the security research community.

Analysts with Palo Alto Networks’ Unit 42 found that Lazarus Group recently sent a barrage of spearphishing emails with booby-trapped Microsoft Word attachments to several individuals involved with different U.S. defense contractors. The hackers did very little to obfuscate their identity; they relied on tools, techniques, and procedures from past, which have already been attributed to North Korean hacking operations.

In this case, the attackers were hoping to force a malware download that would give them wide access to files and other information stored on a victim’s computer.

Interestingly, the payload intended for the U.S. defense contractors is almost identical to what Lazarus Group used around April to compromise South Korean organizations, based on previous research.

“We’ve identified weaponized Microsoft Office Document files which use the same malicious macros as attacks from earlier this year. Based on the contents of these latest decoy documents which are displayed to a victim after opening the weaponized document the attackers have switched targets from Korean language speakers to English language speakers,” wrote senior threat researcher Anthony Kasza. “Most notably, decoy document themes now include job role descriptions and internal policies from U.S. defense contractors.”

In order to send these targeted phishing emails, Lazarus Group relied on already compromised machines to host the weaponized documents. By using a proxy in this manner, attackers can sometimes confuse investigators that are looking for links between an infected computer and the machine its communicating with to download malicious programs.

In recent years, North Korean hackers are believed to have successfully broken into Sony Pictures, the Bangladesh Bank and a foreign policy advisory group to Hillary Clinton’s presidential campaign.

This is not the first time a foreign nation has employed hackers to spy on U.S. defense contractors.

In September 2014, a comprehensive report authored by the Senate Armed Services Committee blamed China for a series of data breaches affecting U.S. Transportation Command contractors. The culprits were able to gain wide access to computers used by these contractors, allowing them to potentially acquire sensitive documents, flight details, credentials and passwords for encrypted emails.

Senators described the findings as “evidence of China’s aggressive actions in cyberspace.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure