North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware

A prolific North Korean state-sponsored hacking group has been
tied to a new ongoing espionage campaign aimed at exfiltrating
sensitive information from organizations in the defense
industry.

Attributing the attacks with high confidence to the Lazarus Group^[1], the new findings from
Kaspersky signal an expansion of the APT actor’s tactics by going
beyond the usual gamut of financially-motivated crimes to fund the
cash-strapped regime.

This broadening of its strategic interests happened in early
2020 by leveraging a tool called ThreatNeedle, researchers
Vyacheslav Kopeytsev and Seongsu Park said in a Thursday
write-up.

At a high level, the campaign leverages a multi-step approach
that begins with a carefully crafted spear-phishing attack leading
eventually to the attackers gaining remote control over the
devices.

ThreatNeedle is delivered to targets via COVID-themed emails
with malicious Microsoft Word attachments as initial infection
vectors that, when opened, run a macro containing malicious code
designed to download and execute additional payloads on the
infected system.

The next-stage malware functions by embedding its malicious
capabilities inside a Windows backdoor that offers features for
initial reconnaissance and deploying malware for lateral movement
and data exfiltration.

“Once installed, ThreatNeedle is able to obtain full control of
the victim’s device, meaning it can do everything from manipulating
files to executing received commands,” Kaspersky security
researchers said^[2].

Kaspersky found overlaps between ThreatNeedle and another
malware family called Manuscrypt that has been used by Lazarus
Group in previous hacking campaigns against the cryptocurrency and
mobile games industries, besides uncovering connections with other
Lazarus clusters such as AppleJeus^[3], DeathNote, and Bookcode^[4].

Interestingly, Manuscrypt was also deployed in a Lazarus Group
operation last month, which involved targeting the cybersecurity
community^[5] with opportunities to
collaborate on vulnerability research, only to infect victims with
malware that could cause the theft of exploits developed by the
researchers for possibly undisclosed vulnerabilities, thereby using
them to stage further attacks on vulnerable targets of their
choice.

Perhaps the most concerning of the development is a technique
adopted by the attackers to bypass network segmentation protections
in an unnamed enterprise network by “gaining access to an internal
router machine and configuring it as a proxy server, allowing them
to exfiltrate stolen data from the intranet network to their remote
server.”

The cybersecurity firm said organizations in more than a dozen
countries have been affected to date.

At least one of the spear-phishing emails referenced in the
report is written in Russian, while another message came with a
malicious file attachment named “Boeing_AERO_GS.docx,” possibly
implying a U.S. target.

Earlier this month, three North Korean hackers associated with
the military intelligence division of North Korea were indicted by the U.S. Justice
Department^[6] for allegedly taking
part in a criminal conspiracy that attempted to extort $1.3 billion
in cryptocurrency and cash from banks and other organizations
around the world.

“In recent years, the Lazarus group has focused on attacking
financial institutions around the world,” the researchers
concluded. “However, beginning in early 2020, they focused on
aggressively attacking the defense industry.”

“While Lazarus has also previously utilized the ThreatNeedle
malware used in this attack when targeting cryptocurrency
businesses, it is currently being actively used in cyberespionage
attacks.”