North Korean APT43 hackers target organizations to launder crypto using cloud

Date:
Wed, 29 Mar 2023 18:42:27 +0000

Description:
Researchers have been tracking the group for five years, but only decided to share the information now.

FULL STORY ======================================================================

Cybersecurity researchers have shared details on a North Korean state-sponsored hacking group thats been operating in the shadows for five years now.

Called APT43, the group was seen targeting governments, and high-profile individuals in the West (the US, Europe), but also in its neighborhood
(Japan, South Korea).

The findings were shared by experts from Mandiant, which described APT43 as a moderately sophisticated group that mostly goes after sensitive information, but sometimes also is just after money, with stolen funds usually going to fund additional cybercrime operations. Laundering cryptos

When stealing money, APT43 mostly targets cryptocurrencies. The researchers spotted the group using fake crypto investment apps for Android, tricking people interested in crypto loans, and stealing their funds, which are later laundered through hash rental and cloud mining services.

When stealing sensitive information, it mostly targets government and
military agencies from North Koreas adversaries:

"The group is primarily interested in information developed and stored within the U.S. military and government, defense industrial base (DIB), and research and security policies developed by U.S.-based academia and think tanks
focused on nuclear security policy and nonproliferation," Mandiant says in
its report .

"APT43 has displayed interest in similar industries within South Korea, specifically non-profit organizations and universities that focus on global and regional policies, as well as businesses, such as manufacturing, that can provide information around goods whose export to North Korea has been restricted." Read more

Google says Chinese hackers are targeting US government Gmail accounts

Microsoft says it took down a Russian cyberattack against Ukraine

These are the best endpoint protection software right now

Mandiants key argument that APT43 is a government player is the fact that its been seen abruptly switching targets, most likely after getting orders from higher echelons.

"More specifically, Mandiant assesses with moderate confidence that APT43 is attributable to the North Korean Reconnaissance General Bureau (RGB), the country's primary foreign intelligence service," the company said. The researchers have been tracking the groups activities since 2018. Check out
our list of the best firewalls right now

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/north-korean-apt43-hackers-target-organizations -to-launder-crypto-using-cloud


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)