sb-nz logo
Story image

Lazarus Group almost certainly connected to North Korea, Group-IB alleges

31 May 2017

Threat intelligence agency Group-IB has published research indicating that the notorious Lazarus Group is well and truly connected to North Korea.

The group has been behind numerous attacks, including one that tried to steal US$1 billion from the Central Bank of Bangladesh. It compromised Polish banks in the process, and Group-IB says that attack was connected to Noth Korea.

The group was also behind the Sony Pictures hack in 2014, and numerous attacks on the South Korean Government.

Group-IB says that detailed analysis of the criminals' Command & Control (C&C) infrastructure and combined threat intelligence pinpointed the group's attacks to Pyongyang.

Further allegations also suggest that the group is controlled by Bureau 121, a division of North Korean intelligence agency Reconnaissance General Bureau.

Group-IB says that its report focused on infrastructure research, rather than malware analysis or attribution that previous reports have used.

The researchers found a 'complex' three-layer architecture, encrypted channels, VPN services and other techniques, but still managed to identify the group's operating location.

Group-IB co-founder and head of Threat Intelligence Department Dmitry Volkov, says the Lazarus Group is thorough and careful.

"Our research testified that North Korean Lazarus group is taking extraordinary precaution measures, dividing the attacks into several stages and launching all the modules manually. So that even if the attack is detected, it would take security researchers much time and effort to investigate it. To mask malicious activity, the hackers used a three-layer C&C infrastructure and pretended to be Russians," he explains.

The group has been using IP addresses across the world, including those of universities in the US, Canada, India and Great Britain, as well as pharmaceutical companies in Japan and China. They have also been using government subnets in various countries, Group-IB says.

"Taking into consideration strengthening economic sanctions against North Korea, as well as the geopolitical tension in the region, we expect a new wave of Lazarus attacks against global financial institutions. With that said, we strongly recommend the banks learn more about targeted attacks' tactics and techniques, increase corporate cybersecurity awareness, and cooperate with the companies providing relevant Threat Intelligence," Volkov adds.

Group-IB is a threat intellience provider with clients across the globe, including Fortune 500 companies in Asia and Australia.

Story image
UiPath and eSentire bring hyperautomation to Microsoft Security
UiPath and eSentire have announced a strategic partnership to deliver end-to-end security policy automation across multiple Microsoft Security services.More
Story image
BayCom partners with NICE inContact to offer cloud contact centre platform in NZ
“With our extensive experience in the industry, BayCom has the ability to design, implement and support CXone nationwide, providing organisations with an industry-leading Contact Centre as a Service (CCaaS) solution to deliver on their customer experience strategies.”  More
Story image
How cyber-attackers use Microsoft 365 tools to steal data
Vectra security research has recently identified how cyber-attackers use Microsoft Office 365 tools against organisations to steal data and take over accounts.More
Story image
Acronis expands global data centre network, including new facilities in NZ
The expansion ensures that the full range of Acronis Cyber Protection Solutions will be available to partners and organisations around the world.More
Story image
Security and operations collaboration key to success post COVID-19
“We are in an ultra-hybrid world with multi-everything, and in order to successfully navigate this landscape, ITOps, DevOps, and SecOps teams need to more closely align."More
Story image
CrowdStrike targets Zero Trust blind spot with new offering
CrowdStrike has officially launched CrowdStrike Falcon Zero Trust Assessment (ZTA), designed to aid in overall security posture by delivering continuous real-time assessments across all endpoints in an organisation regardless of the location, network or user. More