North Korean state-sponsored cybercriminals have been time and again accused of buying access to pre-hacked servers from other threat actors. However, lately, connections have emerged between the North Korea-based Lazarus APT group and some of the prominent Russian-speaking cybercriminal groups.
TrickBot, Dridex, and TA505 are threat groups linked to various Russian-speaking threat actors who sell access to victims’ systems on the dark web. Lazarus has been found to be infrequently using TrickBot’s codes in its attacks.
TrickBot is a privately-run Malware-as-a-Service (Maas) offering, which can be accessed by only top-tier threat actors.
TA505 is a cybercriminal group that has purchased a huge number of tools from the underground.
According to a report by LEXFO, past Lazarus infections have been spotted to coexist with TrickBot and Emotet. TA505 and Lazarus IOCs were found together in bank networks.
North Korea-based hackers may “be working with or contracting out to criminal hacking groups, like TA505, for initial access development.”
Based on the different incidents, experts assess that there is a connection between Lazarus and Russian-speaking cybercriminals.
TrickBot appears to possess a treasure trove of compromised accesses that Lazarus can definitely leverage.
It is very likely that threat actors with access to TrickBot infections are in touch with North Korean state-sponsored hackers. Knowing that there is a link between different threat actors provides defenders an opportunity to identify a potential second problem when the first one occurs.
The Russian military intelligence hackers known as Fancy Bear or APT28 wreaked havoc on the 2016 election.Ever since, the cybersecurity community has been waiting for the day they would return to sow more chaos. Just in time for the 2020 election, that day has come. According to Microsoft, Fancy Bear has been ramping up its election-targeted attacks for the past full year.
Microsoft published a blog post revealing that it has seen Russia’s Fancy Bear hackers, which Microsoft calls Strontium, targeting more than 200 organizations since September 2019. The targets include many election-adjacent organizations, according to researchers at Microsoft’s Threat Intelligence Center.
“The activity we are announcing today makes clear that foreign activity groups have stepped up their efforts targeting the 2020 election as had been anticipated,” Microsoft’s blog post reads. “Microsoft has been monitoring these attacks and notifying targeted customers for several months, but only recently reached a point in our investigation where we can attribute the activity to Strontium with high confidence.”
Microsoft’s blog post also details politically focused hacking campaigns by a Chinese group known as Zirconium or APT31, as well as an Iranian group known as Phosphorous or APT35. The Chinese campaign’s attacks have included 150 successful breaches of organizations in the last six months,
The Iranian campaign, according to Microsoft, has attempted to gain access to multiple accounts of people involved in the 2020 presidential election, as well as multiple members of Trump’s administration and campaign staff in May and June of this year. Those Trump-targeted intrusions were unsuccessful, Microsoft adds.
But it’s Russia’s latest attacks that are the most troubling, according to threat intelligence firm FireEye. That’s because, unlike Iran or China, the Russian military intelligence agency known as the GRU—and specifically the GRU team known as Fancy Bear, believed to be GRU Unit 26165—has a history of going beyond traditional spying to carry out political hack-and-leak operations
The new round of Fancy Bear hacking also shows that the group has evolved since 2016. While it’s still working to steal victims’ account credentials, it has moved on from the email-based spear-phishing attacks linking to fake login pages of the kind that tricked the earlier elections
Those two tactics “have likely allowed them to automate aspects of their operations,” which would let them scale up their targeting. Microsoft also notes that the hackers have evolved their attempts to avoid detection, rotating through more than a thousand IP addresses in their hacking spree, using the anonymity software Tor, and constantly jettisoning IP addresses and adding new ones.
But while the latest Microsoft findings name Russian, Chinese, and Iranian hackers in equal measure, FireEye director of intelligence warns that Americans shouldn’t fall into the trap of thinking those three potential wild cards carry equal risk for American democracy. “APT28 is the threat that really matters here,” Hultquist says. “They have the history, the motivation, and the means to actually interfere.”
