北朝鮮のハッカー集団は、2021年だけで総額450億円相当もの仮想通貨を盗んでいた

北朝鮮のハッカーが2021年にハッキングによって盗んだ仮想通貨が、総額3.95億ドル（約451億円）相当にもなることが明らかになった。これらのハッカーはすべて北朝鮮政府のために働いているとみられ、仮想通貨の窃盗が最重要事項になっていると指摘されている。
…

North Korean hackers said to have stolen nearly $400 million in cryptocurrency last year


North Korean hackers stole nearly $400 million worth of cryptocurrency in 2021, making it one of the most profitable years yet for cybercriminals in the severely isolated country, according to a new report. 

Hackers launched at least seven different attacks last year, mostly targeting corporate investments and centralized exchanges with a variety of tactics including phishing, malware and social engineering, according to a report by Chainalysis, a company that tracks cryptocurrencies. 


Cybercriminals attempted to gain access to organizations’ “hot” wallets: Internet-connected digital wallets, and then transfer funds to accounts controlled by the DPRK. The thefts are the latest indication that the heavily sanctioned country continues to rely on a network of hackers to help fund its domestic programs. 


A confidential UN report previously accused North Korean regime leader Kim Jong Un of carrying out “operations against formerly moving financial institutions and virtual currency” to pay for weapons and keep the country afloat North Korean economy. 


Last February, the US Department of Justice  charged three North Koreans with conspiring to steal more than $1.3 billion from banks and businesses around the world and orchestrating crypto thefts. digital currency.


“North Korea is, in most respects, cut off from the global financial system by a long sanctions campaign by the United States and its foreign partners.” said Nick Carlsen, an analyst at blockchain intelligence firm TRM Labs. “As a result, they have taken to the digital battlefield to steal cryptocurrencies, essentially [a] high-speed internet bank robbery, to fund weapons programs, nuclear proliferation and other activities. 

>


North Korea’s hacking efforts have benefited from this.The rise in value of Rising prices and the use of cryptocurrencies have generally made digital assets increasingly attractive to malicious actors, which led to more successful cryptocurrency thefts in 2021. 


According to Chainalysis, most of the thefts in the past year were committed by the Lazarus Group, a hacker group with ties to North Korea that was previously  linked to the  Sony Pictures hack, among other incidents. ie North Koreans, in addition to sanctiones cybersecurity defensive measures such as crimes such as criminql have no real chance of being extradited. 


As the cryptocurrency market becomes more popular, “we are likely to see continued interest from North Korea in targeting cryptocurrency companies that are young and that are building  cyber defenses and anti-virus controls. -money laundering,” Carlsen said.

New Flagpro malware linked to Chinese state-backed hackers

Hacker


 The cyber espionage group APT (Advanced Persistent Threat) Blackwell has been targeting Japanese companies with a new type of malware that researchers call “Flag pro”. Second level malware and run it. 

Breaching corporate networks

The chain of infection begins with a phishing e-mail that was developed for the target organization and pretends to be a message from a trusted partner.

 The e-mail contains a password-protected ZIP or RAR attachment with a Microsoft Excel file [.XLSM] linked to a malicious macro. Running this code creates an executable file in the Flag pro home directory. 

When it first runs, Flagpro connects to the C2 server over HTTP and sends the system identification details obtained by executing hard-coded operating system commands. 

In response, the C2 can send additional commands or a second-level payload that Flag pro can execute. 

An example of a sent command Source: NTT Security

Communication between the two is base64 encoded, and there is also a configurable delay between connections to avoid creating an identifiable operating model.

Flagpro

Communication between Flagpro and the C2 Source: NTT Security

 Flagpro has been used against Japanese companies for more than a year, at the latest since October 2020, according to a report by NTT Security. 

The most recent samples the researchers were able to obtain are from July 2021. The target companies are from a variety of industries, including defense, media and communications technology. 

Flagpro v2.0

At some point in their analysis, NTT researchers noticed a new version of Flag pro that can automatically close relevant dialog boxes to make external connections that could reveal their presence to the victim. 

“In the Flag pro v1.0 implementation, if a dialog box titled ‘Windows セ キ ュ リ テ ィ’ appears when Flagpro is accessing an external site, Flagpro will automatically click the OK button to close the dialog box” explains NTT Security report. “This handling also works if the dialog is written in Chinese or English  indicates destinations are in Japan, Taiwan, and English-speaking countries.

Flagpro

Inserted code serving as obfuscation in Flagpro v2.0 Source: NTT Security

 Blackwell APT is a lesser known player discovered by Trendier researchers in the summer of 2017 and has partnered with China. His typical targets are in Taiwan, although he has occasionally targeted companies in Japan and Hong Kong to steal technology.

 In February  2021, a report from Unit 42 linked  Blackwell to Waterbear Flag pro, another cyber espionage group believed to have the backing of the Chinese government like Apt, Black tech, Knowledge and Refinement to adapt their tools to new reports like this one, Flag pro is likely to be modified for more stealth use.

As the NTT report concludes, “Recently they (Blackwell) started using another new malware called Selfsame Loader and Spider RAT. “That means they are actively developing new malware. Defenders should be aware of the new indicators of exposure to new malware and follow all security best practices to maintain a strong defense against sophisticated threats like Blackwell.

Source: Bleeping Computer

国家間のサイバー攻撃の応酬が「生活インフラ」に波及し、一般市民を巻き込み始めた

数十年にわたって対立しているイランとイスラエルの間で、サイバー攻撃の応酬が激化している。そのハッキングの対象は燃料供給システムや鉄道管制システム、航空会社などにまで及び、一般市民の生活が脅かされる事態にまで発展している。
…

静かなるハッキング手法「水飲み場型攻撃」が、あなたを狙っている

正規のウェブサイトを侵害することでサイトの訪問者のデヴァイスをハッキングする「水飲み場型攻撃」という手法が広まっている。水源を汚染して水を飲んだ人を感染させる手口に由来するこのハッキング手法は、静かに実行されることから成功率が高く、その危険性も高まっている。
…