North Korean Hackers Target Japanese Financial Firms with New Malware

A new report from cybersecurity firm Kaspersky has uncovered a new hacking spree linked to notorious North Korean hackers using malware.

The report identified BlueNoroff, an arm of the state-sponsored Lazarus Group, as the principal suspect behind the recent attacks. BlueNoroff's main targets appear to be digital asset startups, commercial banks, and venture capitalist (VC) firms in Europe and the Far East.

Kaspersky's researchers note that BlueNoroff has been under the radar for most of 2022, but in the last quarter, the group showed signs of activity. BlueNoroff created nearly 80 fake websites, mimicking popular VC firms and financial institutions, with the majority of sites focused on Japanese companies.

"The actor usually used fake domains such as cloud hosting services for hosting malicious documents or payloads," said Kaspersky. "Most of the companies are Japanese companies, indicating the actor has a keen interest in Japanese markets."

BlueNoroff's latest attacks have shown a strong capability of bypassing Mark-of-the-Web by expanding file types and tweaking its latching strategies. Once access has been obtained, the malware interrupts digital asset transfers by changing the recipient's address.

The report indicates that BlueNoroff's malware can "push the transfer amount to the limit, essentially draining the account in a single transaction."

It is unclear why Japanese firms are the hacking group's target, especially given Japan's expansive cybersecurity infrastructure tradition. Kaspersky notes that the hacking gang has been prolific, "stealing cryptocurrency worth millions" in the few months they began operations.

North Korean hackers have risen to notoriety in 2022 for their daring attacks on the virtual currency industry, stealing billions along the way.

(Source: COINGEEK)