Recently, Google announced that a North Korean government-backed hacking group known as the Lazarus Group has targeted members of the cyber-security community who specialize in vulnerability research. Google’s Threat Analysis Group (TAG) stated that the hacking group specializes in using social network groups to target security researchers and infect their operating systems with a customized backdoor malware. It’s believed that the cybercriminals hacked multiple profiles on platforms such as Twitter, LinkedIn, Telegram, Discord, Keybase, and some email to target the Google security team, which focuses on hunting down advanced persistent threat (APT) groups. The threat actors began with creating fake Twitter accounts to masquerade as security researchers, and then reached out on social media to legitimate security researchers.
“After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with a Visual Studio Project,” said Adam Weidemann, a security researcher with Google TAG.
The Visual Studio Project however came already infected with malicious code that installed malware on the targeted researcher’s computer. The malware contacted a control server and waited for commands. Curiously, not every target received malware. Some simply were asked to visit a fake blog. This led some to speculate that the Lazarus Group was not working alone. The blog hosted malicious code, however, so the end result was still the same: the target’s computer was infected after visiting the site.
Of particular note was the fact that many of the researchers who were targeted and visited the site were running fully patched and up-to-date Windows 10 and Chrome browser versions and still got infected, according to Google TAG. Some believe that the cybercriminals used a combination of Windows 10 and Chrome zero-day vulnerabilities. For those that don’t know, the term zero-day vulnerability refers to an area that needs to be patched but has not yet been discovered by researchers and software developers. In most cases, the hackers discover them first.
To add to the confusion, threat actors authored several online articles and videos that analyzed these vulnerabilities to give them credibility and gain the trust of the researchers they were targeting. One of the targets got wise and called out the threat actors’ video as a fake. Not to be outdone, the threat actors began creating Twitter sock puppet account to refute these claims.
The Google TAG Team is asking anyone who believes they were also targeted to come forward so more information can be amassed about the identity of the attackers, as well as take steps to make sure they haven’t been infected. They’re also advising security researchers to review their browsing histories to check if they’ve interacted with any of the fake profiles or visited the infected blogsite. Google has published a site of all the known profiles here. The infected blogsite is under the domain name (DO NOT CLICK) blog.br0vvnn.io.
The reason behind this attack is of particular interest as well. If successful (and at the time of this blog going to print, there’s still much that is not known about how widespread and how damaging the attacks have been), it could allow North Korea to steal exploits for vulnerabilities discovered by the researchers who have been infected. These vulnerabilities could be deployed by the threat actors in future attacks with little to no cost involved where development is concerned.
Since the attack, which is believed to have been rolled out as early as January 25th, several security researchers have discussed being targeted, but none have actually admitted to having had their systems compromised, so at this time, it’s still early days in terms of figuring out how far-reaching the damage actually is.
For anyone concerned that they have been targeted by the hackers, the Google Tag Team advised:
“If you are concerned that you are being targeted, we recommend that you compartmentalize your research activities using separate physical or virtual machines for general web browsing, interacting with others in the research community, accepting files from third parties and your own security research,”
If you have questions about what preventative steps you can take to protect your business or other assets from a cyber attack, don’t hesitate to reach out to us. At Buzz Cybersecurity, we offer a variety of services including Free Lunch & Learns, Cloud Solutions, Managed IT Services, Infrastructure as Service, Support Consulting, Ransomware Protection, and more.
Every business is different, and we would love to talk with you about tailoring a plan that fits the size of your company, as well as fits your budget. Contact us today for your free assessment!
Image by Sammy-Williams from Pixabay