North Korean hackers have continued their assault on cryptocurrency exchanges and related businesses, cyber-security firm Kaspersky Lab said yesterday in a report.
The company said it detected ongoing campaigns targeting the staff of cryptocurrency businesses with malicious documents that later would download and install either Windows or Mac malware.
The current ongoing attacks are a direct continuation of activity that Kaspersky previously documented last August in the Operation AppleJeus report.
That report detailed a series of attacks by the Lazarus Group (a codename given to a division of North Korea's state hackers) that targeted Asia-based cryptocurrency exchanges.
The report also detailed the first use of Mac malware by North Korean hackers, which now appears to have become a de-facto mode of operation.
Kaspersky's latest update shows that the group has not stopped their attacks after having their activities exposed --which isn't a surprise, as North Korean hackers tend to continue attacks even after public disclosure, unlike their Chinese or Russian counterparts that typically halt operations and rotate server infrastructure to hide their tracks.
North Korean hackers responsible for $670 million in cyberthefts
By now, it is widely known that North Korean hacking activities are usually split down the middle. Some hacking efforts focus on intelligence gathering and cyber-espionage, while other Lazarus operations are purely centered around the theft of fiat currency from real-world banks or cryptocurrency funds from online exchanges.
A report published earlier this month and authored by the United Nations panel on threat intelligence concluded that North Korean hackers stole around $571 million from at least five cryptocurrency exchanges in Asia between January 2017 and September 2018. The report also claimed that the Pyongyang regime amassed nearly $670 million in foreign and virtual currency through cyberthefts.
The UN report echoes two other reports published in October 2018, which also blamed North Korean hackers for two cryptocurrency scams and five trading platform hacks.
A FireEye report from October 2018 also blamed North Korean hackers for carrying out bank heists of over $100 million.
Another report published in January this year claimed that North Korean hackers infiltrated Chile national ATM network after tricking an employee to run malicious code during a Skype job interview, showing the resolve Lazarus Group operators usually have when they have to infiltrate organizations in search for funds to steal.
New cryptocurrency hacks happening every week
In the meantime, hacks of cryptocurrency exchanges continue to happen on a weekly basis, and in many instances, users and threat analysts often wonder if this is just the latest work of North Korean hackers (or some inside job).
Pyongyang cyber-espionage operations in full throttle
But besides operations focused on money theft, North Korean hackers are also still busy with their intelligence gathering and relentless cyber-espionage operations, which have also never stopped.
South Korean security researchers are exposing such attacks on South Korean users and government organizations on a daily basis, exposing new spear-phishing campaigns with different lures at an astounding pace.
Not all of these operations are limited to South-East Asia and North America region were North Korean hackers usually tend to gather threat intelligence from.
A report published yesterday by Israeli newspaper Haaretz revealed that North Korea's Lazarus Group also targeted a private Israeli defense company in search for sensitive information in what the newspaper called one of the first North Korean hacks against Israel.
In spite of being such a small state and under heavy economic sanctions, North Korea has managed to become one of today's most active cyber actor and an adversary to be feared.
Despite being called out by governments around the world for its practice, the Pyongyang hackers have gone about their business as normal.
Related malware and cybercrime coverage:
- Police Federation hit by ransomware attack
- Google fixes Chrome 'evil cursor' bug abused by tech support scam sites
- Lithuanian man pleads guilty to scamming Google and Facebook out of $123 million
- Hackers abuse Magento PayPal integration to test validity of stolen cards
- LockerGoga bug crashes ransomware before encrypting files
- Top dark web marketplace will shut down next month
- How the United Nations helps fight global cybercrime TechRepublic
- Google blocked 2.3 billion bad ads in 2018 CNET