2024

Discord

<div class="coinjournal">
 <ul>
  <li>North Korean hackers deploying “Durian” malware targeting South Korean crypto firms.</li>
  <li>The resurgence of dormant hackers like Careto underscores the evolving cybersecurity landscape.</li>
  <li>Hacktivist groups like SiegedSec escalate offensive operations amidst global socio-political events.</li>
 </ul>
 <p>The first quarter of 2024 has proven particularly eventful, with notable findings and trends emerging from the frontline of cyber security. From the deployment of sophisticated malware variants to the resurgence of long-dormant threat actors, the landscape of cyber threats continues to shape-shift, presenting new challenges for security experts worldwide.</p>
 <p>A recent <a rel="noopener noreferrer nofollow" title="report" href="https://thebittimes.com/tag/report.html">report</a> by the Global Research and <a rel="noopener noreferrer nofollow" title="Category Analysis" href="https://thebittimes.com/analysis.html">Analysis</a> Team (GReAT) at Kaspersky made a striking revelation shedding light on the activities of various advanced persistent threat (APT) groups.</p>
 <h2 id="the-durian-malware-targeting-south-korean-crypto-firms">The Durian malware targeting South Korean crypto firms</h2>
 <p>Among the findings made by GReAT is the emergence of the “Durian” malware, attributed to the North Korean hacking group Kimsuky. It has been used to target South Korean <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a>currency firms and it has a high level of sophistication, boasting comprehensive backdoor functionality.</p>
 <p>The Durian malware’s deployment marks a notable escalation in the cyber capabilities of Kimsuky, showcasing their ability to exploit vulnerabilities within the supply chain of targeted organizations.</p>
 <p>By infiltrating legitimate security software exclusive to South Korean <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> firms, Kimsuky demonstrates a calculated approach to circumventing traditional security mechanisms. This modus operandi highlights the need for enhanced vigilance and proactive security strategies within the <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a>currency sector, where the stakes are exceptionally high.</p>
 <h2 id="the-connection-between-kimsuky-and-the-lazarus-group">The connection between Kimsuky and the Lazarus Group</h2>
 <p>The Kaspersky report further unveils a nuanced connection between Kimsuky and another North Korean hacking consortium, the Lazarus Group. While historically distinct entities, the utilization of similar tools such as LazyLoad suggests a potential collaboration or tactical alignment between these crypto-threat actors.</p>
 <p>This discovery underscores the interconnected nature of cyber threats, where alliances and partnerships can amplify the impact of malicious activities.</p>
 <h2 id="resurgence-of-dormant-crypto-hacking-groups">Resurgence of dormant crypto hacking groups</h2>
 <p>In parallel, the APT trends <a rel="noopener noreferrer nofollow" title="report" href="https://thebittimes.com/tag/report.html">report</a> <a rel="noopener noreferrer nofollow" title="reveals" href="https://thebittimes.com/tag/reveals.html">reveals</a> a resurgence of long-dormant threat actors, such as the Careto group, whose activities were last observed in 2013.</p>
 <p>Despite years of dormancy, Careto resurfaced in 2024 with a series of targeted campaigns, employing custom techniques and sophisticated implants to infiltrate high-profile organizations. This resurgence serves as a stark reminder that cyber threats never truly disappear; they merely adapt and evolve.</p>
 <h2 id="other-crypto-hacking-groups-terrorising-the-world">Other crypto hacking groups terrorising the world</h2>
 <p>The Kaspersky report also highlights the emergence of new malware campaigns targeting government entities in the Middle East, such as “DuneQuixote”. Characterized by sophisticated evasion techniques and practical evasion methods, these campaigns underscore the evolving tactics of threat actors in the region.</p>
 <p>There is also the emergence of the “SKYCOOK” implant utilised by the Oilrig APT to target internet service providers in the Middle East.</p>
 <p>Meanwhile, in Southeast Asia and the Korean Peninsula, the activities of threat actors like DroppingElephant continue to pose significant challenges. Leveraging malicious RAT tools and exploiting platforms like Discord for distribution, these actors demonstrate a multifaceted approach to cyber espionage. The use of legitimate software as initial infection vectors further complicates detection and mitigation efforts, highlighting the need for enhanced threat intelligence and collaboration among stakeholders.</p>
 <p>On the hacktivism front, groups like SiegedSec have ramped up their offensive operations, targeting companies and government infrastructure in pursuit of social justice-related goals. With a focus on hack-and-leak operations, these groups leverage current socio-political events to amplify their message and impact.</p>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/kaspersky-s-report-reveals-new-tactics-used-by-north-korean-crypto-hackers-tbt88164.html">https://thebittimes.com/kaspersky-s-report-reveals-new-tactics-used-by-north-korean-crypto-hackers-tbt88164.html</a></p>

Kaspersky’s report reveals new tactics used by North Korean crypto hackers

Table of Contents

TheBitTimes

Other articles published on May 13, 2024

Bitcoin Magazine CEO Shapes Trump’s Crypto Policy Agenda

Bitcoin miner Bitfarms CEO to depart immediately in response to lawsuit

A new roadmap was presented by the Ethena developers.

Bitcoin Analysts Predict Upward Price Movement

Hong Kong Police Search for Kidnappers in Crypto Investor Abduction Case

Ethereum sees $12M whale transfer: What about ETH’s price?

Join our free newsletter for daily crypto updates!