Tag Archive for: Korean

Google: North Korean hackers are targeting researchers through fake offensive security firm

/in


A North Korean hacking group known to have targeted security researchers in the past has now upped its game through the creation of a fake offensive security firm. 

The threat actors, believed to be state-sponsored and backed by North Korea’s ruling party, were first documented by Google’s Threat Analysis Group (TAG) in January 2021. 

Google TAG, specialists in tracking advanced persistent threat (APT) groups, said at the time that the North Korean cyberattackers had established a web of fake profiles across social media, including Twitter, Keybase, and LinkedIn. 

“In order to build credibility and connect with security researchers, the actors established a research blog and multiple Twitter profiles to interact with potential targets,” Google said. “They’ve used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits, and for amplifying and retweeting posts from other accounts that they control.”

When members of the group reached out to their targets, they would ask if their intended victim wanted to collaborate on cybersecurity research — before sending them a malicious Visual Studio project containing a backdoor. Alternatively, they may ask researchers to visit a blog laden with malicious code including browser exploits. 

In an update posted on March 31, TAG’s Adam Weidemann said that the state-sponsored group has now changed tactics by creating a fake offensive security company, complete with new social media profiles and a branded website. 

The fake company, dubbed “SecuriElite,” was set up on March 17 as securielite[.]com. SecuriElite claims to be based in Turkey and offers penetration testing services, software security assessments, and exploits. 

screenshot-2021-04-01-at-06-56-25.png

A link to a PGP public key has been added to the website. While the inclusion of PGP is standard practice as an option for secure communication, the group has used these links in the past as a means to lure their targets into visiting a page where a browser-based exploit is waiting to deploy. 

In addition, the SecuriElite ‘team’ has been furnished with a fresh set of fake…

Source…

North Korean military hackers indicted in cyber plot to rob banks, attack companies

/in


Three North Korean computer programmers have been charged in Los Angeles with conspiring to steal and extort more than $1 billion in a sweeping array of cyberattacks against banks, other companies and cryptocurrency traders around the world, federal authorities announced Wednesday.



Kotaro Koizumi et al. posing for the camera: From left, Park Jin Hyok, Kim Il and Jon Chang Hyok are accused of conspiring to steal more than $1 billion in a sweeping array of cyberattacks. (U.S. Justice Department)

© (U.S. Justice Department)
From left, Park Jin Hyok, Kim Il and Jon Chang Hyok are accused of conspiring to steal more than $1 billion in a sweeping array of cyberattacks. (U.S. Justice Department)

The hackers were working for a North Korean military agency, the Reconnaissance General Bureau, and pursuing strategic and financial goals of the country’s leader, Kim Jong Un, authorities said.

In an indictment unsealed Wednesday, a federal grand jury in Los Angeles charged that Jon Chang Hyok, Kim Il and Park Jin Hyok attacked banks, entertainment companies, online casinos, defense contractors, energy utilities and others in the U.S., Bangladesh, Mexico, Indonesia, Britain, Vietnam, Pakistan and other countries.



a group of people walking down a street next to a sign: Federal authorities say embarrassing emails of Sony executives were hacked by North Korean computer programmers and made public as revenge for the studio's release of "The Interview," a comedy that mocked North Korea's leader, Kim Jong Un. (Christopher Polk / Getty Images)

© (Christopher Polk / Getty Images)
Federal authorities say embarrassing emails of Sony executives were hacked by North Korean computer programmers and made public as revenge for the studio’s release of “The Interview,” a comedy that mocked North Korea’s leader, Kim Jong Un. (Christopher Polk / Getty Images)

The victims included Sony Pictures Entertainment Inc. Embarrassing emails sent by Sony executives were made public in 2014, allegedly in retaliation for the studio’s release of “The Interview,” a comedy film that depicted the fictional assassination of Kim Jong Un. One of the accused hackers, Park, was charged in the Sony attack in 2018, and now the other two men are accused of having a hand in the incursion as well.

Beyond the Sony attack, the indictment announced Wednesday alleges a broader scheme to carry out various cybercrimes, including the attempted theft of $1.2 billion from banks across the globe, wide distribution of malicious cryptocurrency apps and spear-phishing campaigns to penetrate computer systems of U.S. defense contractors, the Pentagon and the U.S. State Department.

“As laid out in today’s indictment, North Korea’s…

Source…

Nigerian Instagram star helped North Korean hackers in $1.3B scheme: Feds

/in


A Nigerian Instagram star conspired with North Korean hackers to steal more than $1.3 billion from companies and banks in the U.S. and other countries, federal prosecutors said.

Ramon Olorunwa Abbas, 37, also known as “Ray Hushpuppi,” is being accused of helping three North Korean computer hackers steal the funds from companies and banks, including one in Malta, in February 2019, according to the Justice Department.

“North Korea’s operatives, using keyboards rather than guns, stealing digital wallets of cryptocurrency instead of sacks of cash, are the world’s leading bank robbers,” Assistant Attorney General John Demers of the Justice Department’s National Security Division said in a statement on Feb. 17.

Abbas — who has 2.5 million followers on Instagram, where he would post photos of his luxury cars — somehow found time for still more banking-related crimes, the feds say.

He worked with Ghaleb Alaumary, 37, a Canadian who was charged with laundering millions of dollars from ATMs in the U.S. and Pakistan and a bank in India, prosecutors say.

Last July, the Nigerian national was arrested in still another, separate case.

He was extradited from Dubai to the U.S. where he was charged with “laundering hundreds of millions of dollars from business email compromise (BEC) frauds and other scams, including schemes targeting a US law firm, a foreign bank and an English Premier League soccer club,” according to the Justice Department.

Source…

Hushpuppi, alleged internet fraudster, named among North Korean bank hackers

/in


Ramon Olorunwa Abbas popular known as Hushpuppi has been linked to North Korean hackers, who have been described as the biggest bank robbers in the world.

The Instagram celebrity was linked to the North Korean hackers by The Federal Bureau of Investigation, (FBI.).

The Justice Department in a detailed statement released on Friday, February 19, alleged that Hushpuppi took part in a “North Korean-perpetrated cyber-enabled heist from a Maltese bank in February 2019.”

According to the statement, his role was as a collaborator with a North Korean money launderer, Ghaleb Alaumary, 37, based in Mississauga, Ontario, Canada.

“Alaumary agreed to plead guilty to the charge, which was filed in the U.S. District Court in Los Angeles on Nov. 17, 2020.

“Alaumary was a prolific money launderer for hackers engaged in ATM cash-out schemes, cyber-enabled bank heists, business email compromise (BEC) schemes, and other online fraud schemes. Alaumary is also being prosecuted for his involvement in a separate BEC scheme by the U.S. Attorney’s Office for the Southern District of Georgia.

“With respect to the North Korean co-conspirators’ activities, Alaumary organized teams of co-conspirators in the United States and Canada to launder millions of dollars obtained through ATM cash-out operations, including from BankIslami and a bank in India in 2018.

“Alaumary also conspired with Ramon Olorunwa Abbas, aka “Ray Hushpuppi,” and others to launder funds from a North Korean-perpetrated cyber-enabled heist from a Maltese bank in February 2019” the statement read

Hushpuppi was arrested in Dubai in June 2020, and extradited to the US where he is being charged by the United States Attorney’s Office in Los Angeles with conspiring to launder hundreds of millions of dollars from “business email compromise” (BEC) frauds and other scams.

His trial was to have commenced late last year, however, it was delayed by the COVID-19 pandemic.

Read the full US Justice Department statement on Hushpuppi’s alleged involvement with the three North Korean military hackers.

“A federal indictment unsealed today charges three North Korean computer programmers with participating in a wide-ranging…

Source…