Microsoft has linked a North Korean hacking group it tracks as Moonstone Sleet to FakePenny ransomware attacks, which have led to millions of dollars in ransom demands.
While this threat group's tactics, techniques, and procedures largely overlapped with those of other North Korean attackers, it has also slowly adopted novel attack methods, as well as its own custom infrastructure and tooling.
Previously tracked as Storm-17, Moonstone Sleet has been observed attacking both financial and cyberespionage targets using trojanized software, malicious games and npm packages, custom malware loaders, and fake software development companies set up to interact with potential victims on LinkedIn, Telegram, freelancing networks, or via email.
The threat actors were first seen deploying a new custom FakePenny ransomware variant in April, two months after breaching the victim's network.
Unlike previous ransomware attacks coordinated by North Korean state hackers, in which victims were asked to pay $100,000, the ransom demanded by the Moonstone Sleet attackers was $6.6 million in BTC. Microsoft's assessment of this attack concluded that Moonstone Sleet's primary motivation for deploying the ransomware was financial gain.
The group's previous involvement in cyber espionage attacks suggests that their attacks are focused on generating revenue and collecting intelligence.
Since it was first observed, the group has targeted multiple industry verticals, including individuals and organizations in the software and information technology, education, and defense industrial base sectors.
Moonstone Sleet is not the first North Korean hacking group to be linked to ransomware attacks in recent years.
The U.S. and U.K. governments officially blamed the Lazarus Group for the WannaCry ransomware outbreak that devasted hundreds of thousands of computers worldwide in May 2017.
Years later, in July 2022, Microsoft and the FBI also linked North Korean hackers to the Holy Ghost ransomware operation and Maui ransomware attacks against healthcare orgs, respectively.
Christie's confirms breach after RansomHub threatens to leak data.
New ShrinkLocker ransomware uses BitLocker to encrypt your files.
Kimsuky hackers deploy new Linux backdoor in attacks on South Korea.
LockBit says they stole data in London Drugs ransomware attack.
OmniVision discloses data breach after 2023 ransomware attack.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 28 May 2024 18:00:16 +0000