Story image

Lazarus Group almost certainly connected to North Korea, Group-IB alleges

31 May 17

Threat intelligence agency Group-IB has published research indicating that the notorious Lazarus Group is well and truly connected to North Korea.

The group has been behind numerous attacks, including one that tried to steal US$1 billion from the Central Bank of Bangladesh. It compromised Polish banks in the process, and Group-IB says that attack was connected to Noth Korea.

The group was also behind the Sony Pictures hack in 2014, and numerous attacks on the South Korean Government.

Group-IB says that detailed analysis of the criminals' Command & Control (C&C) infrastructure and combined threat intelligence pinpointed the group's attacks to Pyongyang.

Further allegations also suggest that the group is controlled by Bureau 121, a division of North Korean intelligence agency Reconnaissance General Bureau.

Group-IB says that its report focused on infrastructure research, rather than malware analysis or attribution that previous reports have used.

The researchers found a 'complex' three-layer architecture, encrypted channels, VPN services and other techniques, but still managed to identify the group's operating location.

Group-IB co-founder and head of Threat Intelligence Department Dmitry Volkov, says the Lazarus Group is thorough and careful.

"Our research testified that North Korean Lazarus group is taking extraordinary precaution measures, dividing the attacks into several stages and launching all the modules manually. So that even if the attack is detected, it would take security researchers much time and effort to investigate it. To mask malicious activity, the hackers used a three-layer C&C infrastructure and pretended to be Russians," he explains.

The group has been using IP addresses across the world, including those of universities in the US, Canada, India and Great Britain, as well as pharmaceutical companies in Japan and China. They have also been using government subnets in various countries, Group-IB says.

"Taking into consideration strengthening economic sanctions against North Korea, as well as the geopolitical tension in the region, we expect a new wave of Lazarus attacks against global financial institutions. With that said, we strongly recommend the banks learn more about targeted attacks' tactics and techniques, increase corporate cybersecurity awareness, and cooperate with the companies providing relevant Threat Intelligence," Volkov adds.

Group-IB is a threat intellience provider with clients across the globe, including Fortune 500 companies in Asia and Australia.

What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Bitdefender announces security integration with Kaseya
The new partnership will allow VSA by Kaseya’s cloud and on-premises users to deploy and manage security with Bitdefender Cloud Security for MSPs.
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.