APT Hackers Target Manufacturing Sector with Advanced Tools
South Korean manufacturers have recently appeared as the prime target behind attacks conducted by the Andariel Advanced Persistent Threat (APT) group. Its attackers centered around the use of keyloggers, proxy tools, and infostealers to target manufacturers, construction firms, and educational institutions all throughout South Korea. The attack methodology is initiated by the exploitation of preexisting vulnerabilities within Apache Tomcat servers to install backdoors such as Nestdoor, which affords the attackers several different privileges on victim systems, which include remote control, data exfiltration, and command execution.
This attack bears a resemblance to previous campaigns and other APT groups that have been linked to the North Korean government, as research suggests that malicious code was reused of earlier campaigns, along with proxy tools that were previously linked to the Lazarus Group. This suggests some degree of collaboration and, even more worryingly, state backing for the APT group from the North Korean government, which previously was linked to the Lazarus Group behind several high-profile attacks, such as WannaCry, Sony Pictures, and others. This can have massive implications for organizations that focus on the affected sectors in South Korea, as there's little ambiguity regarding the level of technical sophistication and adaptability that North Korean-backed APTs possess. Consequently, more innovative and security focused approaches will be a necessary ingredient to combat the threat.
One of the specific methods that attackers use to gain initial access is to disguise their malware as legitimate software, such as an OpenVPN installer, in order to deceive users into downloading it, upon which attackers will gain access to their systems. Subsequently, once attackers have gained access, they're able to deploy numerous tools for various purposes, such as keyloggers to capture passwords and sensitive information, while their objectives surrounding data exfiltration are accomplished by file stealers that are used to significant effect on compromised machines.
To counter such complex attacks, organizations need to maintain continuous vigilance and awareness surrounding them. As is commonly known, humans are the weakest link in any cybersecurity defense mechanism, and therefore, user education is paramount to prevent spoofed malware from accessing sensitive systems in the first place. Furthermore, organizational collaboration and outreach between cybersecurity teams and governmental liaisons are also crucial so that knowledge is shared, and defensive mechanisms are made more efficient, sound, and secure.
To read more about the attack, feel free to visit Cybersecurity News.
Comments
Post a Comment