North Korea-linked APT targets orgs as part of coordinated espionage campaign

As we speak, the Symantec Menace Hunter Crew launched a blog post reporting that it had noticed a sophisticated persistent risk group (APT) often called Lazarus, orchestrating an espionage marketing campaign to focus on organizations throughout the chemical sector. 

The group behind the assault, Lazarus, seems to be persevering with a malicious marketing campaign known as Operation Dream Job, a malicious marketing campaign first found in August 2020, the place attackers e mail enticing pretend job provides to staff to trick them into opening malware attachments or clicking on hyperlinks by to malware-hosting web sites.

Whereas this assault primarily focused organizations within the chemical sector it additionally focused a lot of corporations within the IT sector in addition to people throughout the protection, authorities, and engineering sectors. 

Why enterprises want a method to mitigate espionage-style assaults   

Many organizations have lengthy feared the development of state-sponsored assaults, with 80% of organizations reporting worrying about their group falling sufferer to a nation-state cyberattack. 

Now with Lazarus utilizing these espionage ways to steal mental property, extra attackers are going to begin to imitate these strategies to achieve entry to protected data and controlled information throughout all sectors.  

 “The very first thing to say is that espionage operations of this sort can and do goal non-public organizations. We’ve seen Operation Dream Job hit a variety of sectors at this stage, To guard themselves, organizations ought to undertake a protection in-depth technique, utilizing a number of detection, safety, and hardening applied sciences to mitigate threat at every level of the potential assault chain,” mentioned Dick O’Brien, principal intelligence analyst for the Symantec Menace Hunter Crew. 

This newest assault has highlighted that spear phishing is among the strongest instruments that risk actors have at their disposal, as an attacker solely must trick an worker into clicking on a single malicious hyperlink or attachment to achieve a foothold within the surroundings. 

A single click on on a hyperlink or attachment can infect their pc with malware and supply an entry level to the community the place the attacker can begin working to ascertain lateral motion all through the community to find vital information property that they’ll steal. 

“It had all of the hallmarks of a basic cyber espionage operation, from the enticing preliminary lure of a pretend job provide, to their capacity to acquire credentials, transfer laterally throughout the goal’s community and be certain that they keep a persistent presence on the community as a way to get the info they’re on the lookout for. It’s apparent that they’re veteran operators, with the information of the best way to fly underneath the radar by maximizing their use of working system options, reputable instruments, or Trojanized variations of reputable instruments,” O’Brien mentioned. 

How one can cease espionage makes an attempt  

Defending in opposition to an assault orchestrated by an APT is not any simple feat. It solely takes one worker to click on on a hyperlink to trigger a full-blown information breach. Because of this, organizations have to optimize their safety defenses in the event that they wish to put together to mitigate espionage threats. 

Measures that O’Brien recommends embody implementing options for monitoring and detecting threats all through your IT surroundings, making certain the most recent model of PowerShell is deployed with logging enabled, and auditing and controlling administrative quantity utilization.  

O’Brien additionally highlights the significance of organizations elevating consciousness worker consciousness of spear phishing, in order that they’re outfitted to identify manipulation makes an attempt every time they encounter them.