North Korean Hackers Turn to Credential Harvesting in Latest Wave of Cyberattacks

Jan 25, 2023Ravie LakshmananCryptocurrency / Malware

A North Korean nation-state group notorious for crypto heists
has been attributed to a new wave of malicious email attacks as
part of a “sprawling” credential harvesting activity targeting a
number of industry verticals, marking a significant shift in its
strategy.

The state-aligned threat actor is being tracked by Proofpoint
under the name TA444, and by the larger
cybersecurity community as APT38, BlueNoroff^[1], Copernicium, and
Stardust Chollima.

TA444 is “utilizing a wider variety of delivery methods and
payloads alongside blockchain-related lures, fake job opportunities
at prestigious firms, and salary adjustments to ensnare victims,”
the enterprise security firm said^[2]
in a report shared with The Hacker News.

The advanced persistent threat is something of an aberration
among state-sponsored groups in that its operations are financially
motivated and geared towards generating illicit revenue for the
Hermit Kingdom.

To that end, the attacks employ phishing emails^[3], typically tailored to
the victim’s interests, that are laden with malware-laced
attachments such as LNK files^[4]
and ISO optical disk images^[5]
to trigger the infection chain.

Among other tactics include the use of compromised^[6]
LinkedIn^[7]
accounts^[8]
belonging to legitimate company executives to approach and engage
with targets prior to delivering booby-trapped links.

More recent campaigns in early December 2022, however, have
witnessed a “significant deviation,” wherein the phishing messages
prompted the recipients to click on a URL that redirected to a
credential harvesting page.

The email blast targeted several verticals besides the financial
sector, including education, government, and healthcare, in the
U.S. and Canada.

The experimentation aside, TA444 has also been observed
expanding the functionality of CageyChameleon^[9]
(aka CabbageRAT) to further aid in victim-profiling, while also
maintaining a wide^[10] arsenal^[11] of post-exploitation tools^[12] to facilitate
theft.

“In 2022, TA444 took its focus on cryptocurrencies to a new
level and has taken to mimicking the cybercrime ecosystem by
testing a variety of infection chains to help expand its revenue
streams,” Proofpoint said.

The findings come as the U.S. Federal Bureau of Investigation
(FBI) accused^[13] the BlueNoroff actors
of carrying out the theft of $100 million in crypto stolen from
Harmony Horizon Bridge in June 2022.

“With a startup mentality and a passion for cryptocurrency,
TA444 spearheads North Korea’s cash flow generation for the regime
by bringing in launderable funds,” Proofpoint’s Greg Lesnewich
said. “This threat actor rapidly ideates new attack methods while
embracing social media as part of their [modus operandi].”

The group “remains engaged in its efforts to use cryptocurrency
as a vehicle to provide usable funds to the regime,” the company
added.