[ad_1]
A North Korean cyberespionage group named Konni has been linked to a sequence of focused assaults aimed on the Russian Federation’s Ministry of Overseas Affairs (MID) with New Yr lures to compromise Home windows methods with malware.
“This exercise cluster demonstrates the affected person and protracted nature of superior actors in waging multi-phased campaigns in opposition to perceived high-value networks,” researchers from Lumen Applied sciences’ Black Lotus Labs mentioned in an evaluation shared with The Hacker Information.
The Konni group’s techniques, methods, and procedures (TTPs) are recognized to overlap with risk actors belonging to the broader Kimsuky umbrella, which can also be tracked by the cybersecurity group below the monikers Velvet Chollima, ITG16, Black Banshee, and Thallium.
The latest assaults concerned the actor getting access to the goal networks by stolen credentials, exploiting the foothold to load malware for intelligence gathering functions, with early indicators of the exercise documented by MalwareBytes way back to July 2021.
Subsequent iterations of the phishing marketing campaign are believed to have unfolded in three waves — the primary commencing on October 19, 2021 to reap credentials from MID personnel, adopted by leveraging COVID-19 themed lures in November to put in a rogue model of the Russian-mandated vaccination registration software program that served as a loader for extra payloads.
“The timing of this exercise carefully aligned with the passage of Russian Vaccine Passport legal guidelines that mandated Russians needed to obtain a QR code from the federal government to show vaccination so as to entry public locations comparable to eating places and bars,” the researchers famous.
The third assault, additionally corroborated by Cluster25 earlier this week, started on December 20, 2021, utilizing New Yr’s Eve festivities as a spear-phishing theme to set off a multi-stage an infection chain that culminated within the set up of a distant entry trojan named Konni RAT.
Particularly, the intrusions transpired by first compromising the e-mail account belonging to a workers member of the MID, from which emails have been despatched to not less than two different MID entities, together with the Russian Embassy in Indonesia and Sergey Alexeyevich Ryabkov, a deputy minister overseeing non-proliferation and arms management.
The e-mail missives seemingly propagated a “Blissful New Yr’s” message, solely to include a trojanized screensaver attachment that is designed to retrieve and run next-stage executables from a distant server. The ultimate stage of the assault is the deployment of the Konni RAT trojan, which conducts reconnaissance of the contaminated machine and exfiltrates the collected data again to the server.
“Whereas this explicit marketing campaign was extremely focused, it’s critical for defenders to know the evolving capabilities of superior actors to attain an infection of coveted targets,” the researcher mentioned, urging organizations to be careful for phishing emails and use multi-factor authentication to safe accounts.
[ad_2]
