Central American Online Casino

lazarus.day

ESET attributed attacks against a Central American online casino to Lazarus, citing overlapping toolsets, telemetry, Lazarus-linked malware, and shared static characteristics. The intrusions used service-oriented NukeSped backdoors, session hijacking, credential theft tools including modified Mimikatz, remote access tooling, and Win32/KillDisk.NBO destructive payloads deployed across more than 100 casino systems, likely serving cover-up, extortion, or sabotage objectives.

CSIS Significant Cyber Incidents

The North Korean hacking group responsible for the SWIFT attacks was found to have targeted a Central American online casino in an attempt to siphon funds.

EuRepoC

The north Korean APT Lazarus hacked an online casino and managed to steal an substantial part of the earnings of the casino

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Researchers from ESET reveal that the infamous Lazarus Group, a malicious actor linked to North Korea, has used a new toolset, including the destructive KillDisk, to target the network of an online Casino in Central America.

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2017-10; Victims: Central American Online Casino; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: Unknown

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from ESET reveal that the infamous Lazarus Group, a malicious actor linked to North Korea, has used a new toolset, including the destructive KillDisk, to target the network of an online Casino in Central America.

"Central American Online Casino 1" was an online casino business headquartered in a Central American country.

On October 13, 2017, having gained unauthorized access to the computer network of Central American Online Casino 1 at an earlier date and stolen its confidential customer information, the hackers extorted payments totaling approximately $2.3 million in cryptocurrency from Central American Online Casino 1.

On November 2, 2017, having gained unauthorized access to the computer network of Central American Online Casino 2 at an earlier date and stolen its confidential customer information, the hackers extorted payments totaling approximately $361,500 in cryptocurrency from Central American Online Casino 2.