Hackers claim to have compromised the computer of a North Korean government hacker and leaked its contents online, offering a rare window into a hacking operation by the notoriously secretive nation.
The two hackers, who go by Saber and cyb0rg, published a report about the breach in the latest issue of Phrack magazine, a legendary cybersecurity e-zine that was first published in 1985. The two hackers wrote that they were able to compromise a workstation containing a virtual machine and a virtual private server belonging to the hacker, whom they call “Kim.” The hackers claim Kim works for the North Korean government espionage group known as Kimsuky, also known as APT43 and Thallium.
Read more…
Source: TechCrunch News
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- U.S., South Korea, Japan to step up actions on North Korea cyber threats
December 9, 2023
The United States, South Korea and Japan agreed new initiatives on Saturday to respond to North Korea’s threats in cyberspace, including cryptocurrency abuses and space launches, White House National Security Adviser Jake Sullivan said. The three countries’ national security advisers met in Seoul as Pyongyang warned that it would deploy more spy satellites. Read more… Source: MSN News
- Diamond Sleet supply chain compromise distributes a modified CyberLink installer
November 22, 2023
Microsoft Threat Intelligence has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet (ZINC) involving a malicious variant of an application developed by CyberLink Corp., a software company that develops multimedia software products. This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads, ...
- Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
November 21, 2023
Unit 42 researchers recently discovered two separate campaigns targeting job-seeking activities linked to state-sponsored threat actors associated with the Democratic People’s Republic of Korea (DPRK), commonly known as North Korea. The research team call the first campaign “Contagious Interview,” where threat actors pose as employers (often anonymously or with vague identities) to lure software developers into ...
- Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability
October 18, 2023
Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server. TeamCity is a continuous integration/continuous deployment (CI/CD) application used by organizations for DevOps and other software development activities. In past operations, Diamond ...
- Assessed Cyber Structure and Alignments of North Korea in 2023
October 10, 2023
Historically Mandiant has made assessments on the Democratic People’s Republic of Korea’s (DPRK) cyber program based on Mandiant responses to intrusions, defector accounts, and OSINT reporting, in conjunction with government disclosures of DPRK units and motivation information. These assessments were generalizations and as new activity, such as cryptocurrency-focused units, emerged it blended the efforts from DPRK ...
- US charges crypto founders over alleged support for North Korean hackers
August 24, 2023
The United States has charged two cofounders of the cryptocurrency mixer Tornado Cash with money laundering and other crimes a year after authorities banned the Russian-founded platform over its alleged support of North Korean hackers. Roman Semenov and Roman Storm have been charged with conspiracy to commit money laundering, conspiracy to commit sanctions violations, and conspiracy ...