The U.S. Department of Homeland Security (DHS) has released a warning against the new BLINDINGCAN remote access trojan (RAT) used by the North Korea-linked Lazarus Group.
What happened?
Last week, the federal agencies reported BLINDINGCAN (aka DRATzarus) having a broad set of technical capabilities to harm victims.
According to reports, the North Korean state-sponsored hackers are using BLINDINGCAN to perform a series of attacks against U.S. and foreign companies from military defense and aerospace sectors.
The hackers impersonate recruiters from big corporations and lure employees into an interviewing process and ask them to open (malicious) Office or PDF documents, which eventually infect their systems.
Once hackers gain access to the victims' systems, they perform reconnaissance to gather intelligence surrounding key military and energy technologies.
The concealed culprit
The U.S. government and the FBI suspect that HIDDEN COBRA threat actors could be behind these activities. The actors are using the BLINDINGCAN malware variants in conjunction with proxy servers to maintain a presence on victim networks and further exploit the network, the FBI claims.
The striking resemblance
The latest attacks share similarities with some recently discovered campaigns.
Between June to August 2020, ClearSky had investigated an offensive campaign, dubbed Operation Dream Job, attributed with high probability to North Korea (possible HIDDEN COBRA).
In the end of July, McAfee Advanced Threat Research (ATR) reported a campaign, dubbed Operation North Star, and attributed it to the Hidden Cobra threat actor.
According ..
Support the originator by clicking the read the rest link below.
