A US government warning last week about new attacks targeting banks in multiple countries has focused attention on what has been a particularly busy year for the Lazarus advanced persistent threat (APT) group.
Over the past several months, the group has ramped up efforts to raise money for its sponsor, the cash-strapped North Korean government, via numerous campaigns targeting organizations in the cryptocurrency space and financial sector. Lately, security researchers have also observed the group launch ransomware attacks on enterprise organizations via virtual hard disk (VHD) files — a somewhat rare tactic so far. The recent campaigns have involved new tools and tactics, including a multiplatform malware framework called MATA for launching attacks against Windows, Linux, and MacOS environments.
The attacks that prompted last week's advisory involves "BeagleBoyz," a group that the Department of Homeland's Cybersecurity and Infrastructure Security Agency (CISA) described as being tracked by others in the security industry as "Lazarus," "APT38," and "Bluenoroff." According to CISA, the group, after a brief lull, has resumed targeting banks in multiple countries in ATM cash-out attacks and to initiate fraudulent international money transfers.
The new round of attacks began in February 2020 and typically has involved the group remotely compromising payment switch servers at banks and then using them to enable fraudulent ATM withdrawals. In one similar attack in 2017, the Lazarus Group enabled the simultaneous withdrawal of money from a victim bank's ATMs in more than 30 countries.
One major concern for banks is the fact that the Lazarus Group's attacks have sometimes rendered banking systems inoperable for extended periods, CISA s ..
Support the originator by clicking the read the rest link below.
