North Korean Hackers Deploy FudModule Rootkit via Chrome Zero-Day Exploit Aug 31, 2024Ravie LakshmananRootkit / Threat Intelligence A recently patched security flaw in Google Chrome and other Chromium web browsers was exploited as a zero-day by North Korean actors in a campaign designed to deliver the FudModule rootkit. The development Read more…
North Korean Hackers Target Brazilian Fintech with Sophisticated Phishing Tactics Threat actors linked to North Korea have accounted for one-third of all the phishing activity targeting Brazil since 2020, as the country’s emergence as an influential power has drawn the attention of cyber espionage groups. “North Korean government-backed actors have Read more…
Microsoft Uncovers 'Moonstone Sleet' — New North Korean Hacker Group A never-before-seen North Korean threat actor codenamed Moonstone Sleet has been attributed as behind cyber attacks targeting individuals and organizations in the software and information technology, education, and defense industrial base sectors with ransomware and bespoke malware previously associated with Read more…
North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign The North Korea-linked Kimsuky hacking group has been attributed to a new social engineering attack that employs fictitious Facebook accounts to targets via Messenger and ultimately delivers malware. “The threat actor created a Facebook account with a fake identity disguised as a Read more…
Black Basta Ransomware Strikes 500+ Entities Across North America, Europe, and Australia The Black Basta ransomware-as-a-service (RaaS) operation has targeted more than 500 private industry and critical infrastructure entities in North America, Europe, and Australia since its emergence in April 2022. In a joint advisory published by the Cybersecurity and Read more…
North Korean Hackers Deploy New Golang Malware 'Durian' Against Crypto Firms The North Korean threat actor tracked as Kimsuky has been observed deploying a previously undocumented Golang-based malware dubbed Durian as part of highly-targeted cyber attacks aimed at two South Korean cryptocurrency firms. “Durian boasts comprehensive backdoor functionality, enabling the execution of Read more…
North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures The North Korea-linked threat actor known as Lazarus Group employed its time-tested fabricated job lures to deliver a new remote access trojan called Kaolin RAT. The malware could, “aside from standard RAT functionality, change the last write timestamp of a selected file Read more…
Microsoft Warns: North Korean Hackers Turn to AI-Fueled Cyber Espionage Microsoft has revealed that North Korea-linked state-sponsored cyber actors has begun to use artificial intelligence (AI) to make its operations more effective and efficient. “They are learning to use tools powered by AI large language models (LLM) to make their Read more…
Ande Loader Malware Targets Manufacturing Sector in North America The threat actor known as Blind Eagle has been observed using a loader malware called Ande Loader to deliver remote access trojans (RATs) like Remcos RAT and NjRAT. The attacks, which take the form of phishing emails, targeted Spanish-speaking users in Read more…
North Korean Hackers Targeting Developers with Malicious npm Packages A set of fake npm packages discovered on the Node.js repository has been found to share ties with North Korean state-sponsored actors, new findings from Phylum show. The packages are named execution-time-async, data-time-utils, login-time-utils, mongodb-connection-utils, and mongodb-execution-utils. One of the packages Read more…