APT groups are state-linked threat actors that run long, targeted campaigns. This month’s analysis covers three. Lazarus, believed to be North Korean, expanded its DeathNote campaign to Linux. BlueNoroff, which researchers link to Lazarus, used RustBucket malware against macOS. The Chinese group Alloy Taurus used a Linux variant of PingPull and a backdoor called Sword2033.
Which APT groups & ransomware gangs were effective this month? The new malware, cyber-attacks, and more are in this monthly analysis.
What Are APT Groups Like Lazarus Doing Now? DeathNote Campaign Targets Linux and RustBucket Malware Hits macOS
Lazarus APT Group Expands DeathNote Campaign to Target Linux Users and New Sectors
North Korean APT group recently has expanded its tactics to target Linux machines with its long-term DeathNote campaign, also known as Operation DreamJob, Operation North Star or NukeSped. This campaign was first discovered on Windows machines in 2019, targeting job seekers from well-known aerospace and defense companies.
The Lazarus Group is a highly sophisticated Advanced Persistent Threat (APT) group believed to have been active since 2009. Its operations are primarily based on ideological reasons and are state-sponsored. The group has strong links to North Korea, and the US Federal Bureau of Investigation has identified it as a North Korean “state-sponsored hacking organization”.
The group’s primary goals include information theft, money extortion, espionage, and sabotage. Lazarus Group has various aliases such as Labyrinth Chollima and HIDDEN COBRA, among others. MITRE ATT&CK tracks APT 38 and Andariel as related groups, not as aliases. They target defense, pharmaceutical, software businesses, cryptocurrency platforms, and electrical industries. Lazarus’s toolset and related malware have been spotted in countries worldwide, including China, India, Iran, Russia, Saudi Arabia, South Korea, and the USA. The threat group has been responsible for numerous cyber-attacks, including the 2014 Sony breach, the 2016 Bangladesh Bank heist, the 2017 WannaCry ransomware attack, and the 2020 pharmaceutical company attacks.
However, with the recent social engineering campaign, the threat group changed its target and aims to deceive software developers and DeFi platform workers through bogus job offers. The scam involves enticing victims to download what appears to be a PDF file, which is a disguised SimplexTea Linux backdoor containing malicious files.
Researchers also have noted that this month’s DeathNote attacks marked Lazarus’s first use of Linux malware. Furthermore, they have expanded their targets beyond just the cryptocurrency industry. The group has been attacking various sectors, including the automotive, academic, and defense industries.
Also, after conducting a comprehensive analysis of the DeathNote campaign targeting Linux users that have recently taken place, researchers found significant similarities between supply chain attacks targeting an enterprise VoIP service provider 3CX, which took place in March 2023 and confirmed the North Korean APT group was behind it.
Lazarus’s Sub-Group BlueNoroff Targeting Telecommunication Sector
BlueNoroff, a state-sponsored North Korean Advanced Persistent Threat (APT) group, has gained notoriety for its sophisticated attacks on financial institutions since 2014. The threat group is associated with the Lazarus Group by researchers and focuses on financial gain, emphasizing banks and financial institutions. They employ spear-phishing, malware, and network infiltration to gain access to their targets.
Despite being a subgroup of Lazarus, BlueNoroff is financially motivated and primarily focuses on gaining monetary benefits from its offensive capabilities. In 2016, the group stole $81 million from the Bangladesh Bank and targeted other financial institutions in Mexico, Poland, and Vietnam.
Simultaneously with Lazarus’s Deathnote campaign in April, BlueNoroff was found responsible for another malware campaign recently targeting Apple’s macOS. The malware, called RustBucket, spread through an application disguised as an “Internal PDF Viewer,” an AppleScript file designed to download a second-stage payload from a remote server. The victim must intentionally bypass the Gatekeeper protections for the attack to succeed. When the victim opens a malicious PDF file, the second-stage payload initiates the next attack phase, which downloads and executes a third-stage trojan. And this Rust-written Trojan executes commands to gather information about the system.
- Disguised appAn AppleScript file posing as an Internal PDF Viewer downloads a second-stage payload from a remote server.
- Victim bypasses GatekeeperThe victim must intentionally bypass the Gatekeeper protections.
- Second stageOpening a malicious PDF file starts the next phase, which downloads and executes a third-stage trojan.
- Third stageThe Rust-written trojan executes commands to gather information about the system.
As a result of the malware investigation, it was found that Lazarus is modifying its toolsets to create cross-platform malware using programming languages such as Go and Rust. However, the method used by BlueNoroff to gain initial access to the system remains to be discovered.
How Does Chinese APT Group Alloy Taurus Expand Its Arsenal with a Linux Variant of PingPull Malware and the Sword2033 Backdoor?
A Chinese APT group called Alloy Taurus, also known as Gallium (MITRE ATT&CK tracks APT41 as a separate group), uses a new version of the PingPull malware to target Linux systems.
MITRE ATT&CK tracks GALLIUM as a cyberespionage group believed to be Chinese state-sponsored, active since at least 2012, that targets telecommunications companies, financial institutions and government entities. It describes the group as exploiting public-facing applications and using web shells and VPN services for persistence.
The group has historically targeted telecommunication companies across Asia, Europe, and Africa. However, it has recently broadened its focus to target financial institutions and government entities. In March 2023, researchers found a Linux variant of PingPull that very few antivirus engines flagged at first (3 out of 62 on VirusTotal), according to Security Affairs. Its command handler resembles the Windows variant, which suggests the group is reusing existing code.
- Also known as
- Gallium
- Active since
- At least 2012 (MITRE ATT&CK)
- Historic targets
- Telecommunication companies across Asia, Europe and Africa
- Recent targets
- Financial institutions and government entities
- New malware
- Linux variant of PingPull and the Sword2033 backdoor
The new Linux variant is configured to communicate with a command-and-control (C2) server.
In addition to the PingPull variant, researchers identified a backdoor named Sword2033. According to Security Affairs, it supports uploading and exfiltrating files and executing commands.
According to Security Affairs, the researchers assess that Alloy Taurus remains an active threat to telecommunications, finance and government organizations, and that its continued evolution supports espionage activities.