Skip to main content

Kaspersky: North Korean hackers are behind the VHD ransomware

North Korean hackers return to actively deploying ransomware after the huge WannaCry debacle.


N Korea Hacker



Antivirus maker Kaspersky said in a report today that hackers associated with the North Korean regime are behind a new ransomware strain known as VHD.

The report details two incidents to which Kaspersky was privy, where intruders gained access to companies' networks and deployed the VHD ransomware.

Kaspersky experts say that tools and techniques used during the two intrusions link the attackers to Lazarus Group -- a generic name given to hackers working for the Pyongyang regime.
This included:

the use of the MATA (Dacls) malware framework to deploy VHD as a final payload
the use of techniques to move across a victim's internal network that were previously observed in past Lazarus campaigns
"The data we have at our disposal tends to indicate that the VHD ransomware is not a commercial off-the-shelf product; and as far as we know, the Lazarus group is the sole owner of the MATA framework. Hence, we conclude that the VHD ransomware is also owned and operated by Lazarus," Kaspersky researchers said today.

Fits in the bigger picture
What Kaspersky has discovered here fits in the bigger picture of the North Korean hacking landscape.

Based on numerous previous reports published over the past four years, North Korean hackers are usually divided into two categories -- (1) those who engage in cyber-espionage for intelligence purposes, and (2) those who engage in financial crime to raise funds for the Pyongyang government (which funds the US Treasury believes are used to support the country's weapons and missile programs).

The VHD attacks are, without a doubt, the work of the second group, which seeks to extort money from hacked organizations.

Some of this group's other money-raising activities included hacking banks, stealing funds from cryptocurrency exchanges, orchestrating ATM cashouts, running crypto-mining botnets, and even engaging in web skimming (Magecart) attacks to steal payment card data and resell it on carding forums.

Other activities also include Lazarus hackers breaking into company networks, stealing data, and then asking victims for a ransom not to publish their data online.

Seeing North Korean hackers engage in ransomware attacks is not surprising, since ransomware attacks are some of today's most profitable cybercrime operations.

It is the hackers' first foray into the scene. Western intelligence agencies have accused North Korea of creating and losing control of the WannaCry ransomware that spread virulently across the globe in May 2017.

The difference between VHD and WannaCry is that VHD is better coded and that Lazarus operators appear to only deploy it sparingly, on the networks of high-profile companies from where they can demand huge ransoms to decrypt data -- in a tactic that's known today as "big game hunting."


Comments

  1. I really liked this post...keep it up brother.

    ReplyDelete
    Replies
    1. Means a lot brother, Jai Sia Ram 🙏❤️

      Delete

Post a Comment

Most Popular Cyber News

Google Task Mate 100% Working Invitation Referral Code – Activate Task Mate Account (Easy Steps)

  Valid and 100% Working Referral Code for Google Task Mate (Beta) Early Access/ Testers : Google India has Launched Task Mate App on 19 November 2020 for the Indian user where you can Earn Money by finding task nearby, complete task i.e. Photo Upload, Record Sentence, Translate Sentences, Check shop details, upload video, etc. As the Task Mate is available to users in Beta Early Access only and for that, you have to enter a valid Invitation Referral Code. Here, Our Website Group (WhatsApp, Telegram and Twitter) Group and Channel are providing valid Referral Codes. Task Mate Beta is currently only available through invitation. Please enter the invitation or referral code below. TaskMate App – Complete Task to Earn Money Article About Valid Invitation Code of Task Mate (Referral Code) Company Google India App Task Mate (Early Access) Version Beta (Early Access) Invitation/ Referral Code Required Validity of Code Only for 100 Users per Invitation Code Website http://www.google.com/ V...

Microsoft’s Windows XP operating system (and other versions) source code has been leaked online

  The source code for Microsoft’s Windows XP operating system (and other versions) has been leaked online!  Published as a torrent file on bulletin board website 4chan, the 43GB data dump is said to have been compiled over the course of the last few months by the leaker. The collection also includes source code for Windows 2000 and multiple versions of Windows CE, MS DOS, Windows Embedded and Windows NT - but all of which have a smaller modern install base than XP. The individual responsible for the leak also appears to bear Bill Gates a distinct grudge, dedicating a whole section of the torrent file to videos slandering the Microsoft founder.  The legitimacy of the leaked code has not yet been confirmed, but Microsoft has been made aware of the issue. Although support for Windows XP lapsed in 2014 - meaning the OS has not received security updates for a number of years - a surprising number of users remain loyal to the outdated operating system. As of last month, 1.26% o...

Pakistan news channel Dawn hacked, screen shows Indian tricolour, Happy Independence Day message

The 'Happy Independence Day' message was shown on the channel in Pakistan around 3:30 pm. A leading Pakistan TV news channel, Dawn, has reportedly been hacked, several photos and videos surfacing online showed. While an advertisement was running on the news channel, the Indian flag appeared over it with a message saying 'Happy Independence Day'. This was spotted by many Twitter users. The message was shown on the channel in Pakistan around 3:30 pm. News Jockey @jockey_news Dawn news channels of Pakistan hacked by Hackers https:// twitter.com/doctoralihamid /status/1289884543084834816/video/1 … 6:46 PM · Aug 2, 2020 56 22 people are Tweeting about  Meanwhile, Dawn News put out a tweet in Urdu saying "The Dawn administration has ordered an immediate investigation into the matter." Issuing a statement, Dawn News said that it was broadcasting as usual when the Indian tricolour and the Independence Day wish appeared over the commercial suddenly, remained on the sc...