A new intelligence gathering campaign linked to the North Korean state-sponsored Lazarus Group has been discovered by Finnish cybersecurity company WithSecure. The campaign, codenamed No Pineapple, exploited known security flaws in unpatched Zimbra devices to compromise victim systems. Targets included a healthcare research organization in India, a chemical engineering department of a leading research university, and a manufacturer of technology used in the energy, research, defense, and healthcare sectors. It is estimated that roughly 100GB of data was exported by the hackers following the compromise of an unnamed customer, likely taking place in the third quarter of 2022. The threat actor gained access to the network by exploiting two security flaws, CVE-2022-27925 and CVE-2022-37042, which allowed them to gain remote code execution on the underlying server. This was followed by the installation of web shells and the exploitation of a local privilege escalation vulnerability in the Zimbra server, enabling the harvesting of sensitive mailbox data. In October 2022, the adversary carried out lateral movement, reconnaissance, and deployed backdoors such as Dtrack and an updated version of GREASE. GREASE, attributed to the North Korea-affiliated Kimsuky group, has the capability to create new administrator accounts with remote desktop protocol privileges and bypass firewall rules. Dtrack, on the other hand, has been used in cyber assaults targeting a variety of industry verticals, as well as financially motivated attacks involving the use of Maui ransomware. At the beginning of November, Cobalt Strike beacons were detected from an internal server to two threat actor IP addresses. Data exfiltration occurred from November 5, 2022, through November 11, 2022. Tools such as Plink and 3Proxy were also used to create a proxy on the victim system. North Korea-backed hacking groups have been active in 2022, conducting espionage-driven and cryptocurrency heists that align with the regimes strategic priorities. Most recently, the BlueNoroff cluster, also known by the names APT38, Copernicium, Stardust Chollima, and Copernicium, and Stardust Chollima, and TA444, was connected to credential harvesting attacks targeting the education, financial, government, and healthcare sectors.
This Cyber News was published on thehackernews.com. Publication date: Thu, 02 Feb 2023 10:16:03 +0000