Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
This week: North Korean-linked hacking group Lazarus attacked the same South Korean financial entity twice in 2022. Also: The number of hard-coded secrets is way up.
According to The Hacker News, Lazarus, a North Korean-linked hacking group, attacked the same financial business entity in South Korea twice in 2022. Lazarus first attacked the organization in May 2022 by exploiting a vulnerable version of a certificate software, used widely by public entities and universities. In the hacking group’s latest attack, occurring in October 2022, Lazarus exploited a zero-day in the same software program.
AhnLab Security Emergency Response Center (ASEC), the firm that discovered both attacks, has not yet disclosed the exploited software, since “the vulnerability has not been fully verified,” ASEC said in an update. In the latest attack, hackers were able to gain access to the system (so far, it is unknown how they did this), and then abused the zero-day bug, allowing them to perform lateral movement. Lazarus then used a Bring Your Own Vulnerable Driver (BYOVD) attack to disable the AhnLab V3 anti-malware engine, which the group has used in prior attacks according to AhnLab and ESET, another cybersecurity firm.
Lazarus also attempted to evade detection by changing file names before deleting them, as well as modifying timestamps using timestomping, an anti-forensic technique. This latest attack also allowed the hacking group to deliver multiple backdoor payloads designed to connect to a remote command-and-control (C2) server, allowing Lazarus to retrieve additional binaries and execute them in a fileless manner.
According to ASEC, Lazarus is a capable threat actor that continually researches software vulnerabilities and changes their TTPs (Techniques, Tactics and Procedures). They do this by “altering the way they disable security products and carry out anti-forensic techniques,” allowing the group to interfere with or delay any detection and analysis. Based on the hacking group’s willingness to exploit new vulnerabilities, it’s likely that they could carry out more attacks in South Korea and elsewhere.
Here are the stories we’re paying attention to this week…
According to GitGuardian’s State of Secrets Sprawl 2023 report, the number of detected hard-coded secrets increased by 67% last year compared to 2021, with 10 million new secrets discovered in public GitHub commits in 2022.
A prolific hacking group known as MuddyWater, which is affiliated with the Iranian government, is responsible for the Feb. 11 cyberattack on Technion University in Israel, the Israeli government said this past Tuesday.
Emotet is a notorious malware distributed through email containing malicious Microsoft Word and Excel document attachments. When users open these documents and macros are enabled, the Emotet DLL will be downloaded and loaded into memory.
The cybersecurity firm Darktrace has warned that since the release of ChatGPT it has seen an increase in criminals using artificial intelligence to create more sophisticated scams to con employees and hack into businesses.
The Trusted Platform Module (TPM) 2.0 specification is affected by two buffer overflow vulnerabilities that could allow attackers to access or overwrite sensitive data, such as cryptographic keys.
The Life and Times of Cybersecurity Professionals study highlights a trend that has accelerated as cyber has become more complex.
SecOps leaders must tackle cost and risk to deliver autonomous vulnerability operations. But with frontier AI, it's critical.
Agentic AI will disrupt how SOC teams are built — and the way CISOs hire. Here’s how to embrace AI.