Hacking tools used by North Korea's Lazarus Group aimed at Russian targets

Check Point cautions that while it’s “problematic” to definitively pinpoint who’s responsible for such an attack, its “analysis reveals intrinsic connections to the tactics, techniques and tools used by the North Korean APT group[.]”

One of the United States’ biggest cyber adversaries has been targeting another, according to new research.

Security vendor Check Point Technologies on Tuesday published findings in which its researchers “were observing what seemed to be a coordinated North Korean attack against Russian entities.” The company cautions that it’s “problematic” to definitively pinpoint who’s responsible for such an attack, though “analysis reveals intrinsic connections to the tactics, techniques and tools used by the North Korean APT group[.]”

Lazarus has been blamed for highly publicized attacks on Sony Pictures, the Bangladesh Bank heist, and could be a key part of North Korean efforts to evade international sanctions by pursuing international espionage. The suspicious activity in this attack occurred “over the past few weeks,” the company said.

Check Point said its researchers were tracking malicious Microsoft Office documents that appeared to be designed specifically targeted at Russian victims. A closer inspection of the hacking tools revealed that they were part of KEYMARBLE, a malware family the U.S. Department of Homeland Security described in 2018 as a variant used by the North Korean government.

“This incident … represents an unusual choice of victim by the North Korean threat actor,” Check Point researchers wrote. “Usually, these attacks reflect the geopolitical tension between the DPRK and nations such as the U.S., Japan and South Korea. In this case, though, it is probably Russian organizations who are the targets.”

Hackers typically used a ZIP file containing a PDF document and a Microsoft Word file laced with malware. The Word file used a Microsoft tool known as a VBScript to access a Dropbox URL, and ultimately download a nefarious EXE file. All of the documents had a Korean code page and cited “home” as the author identity.

Check Point did not identify the hacking targets by name, however one file contains a non-disclosure agreement that appears to come from StarForce Technologies, a software company headquartered in Moscow.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure