Komisja Nadzoru Finansowego · 2016-10
The KNF incident centered on a watering-hole compromise of the Polish Financial Supervision Authority website, where modified JavaScript redirected selected financial-sector visitors through sap.misapor[.]ch and eye-watch[.]in toward exploit and payload delivery. Follow-on analysis described multi-stage, obfuscated malware with encrypted C2, service persistence, file and process-control commands, and Ratankba/Hacktool components, while BAE Systems, Symantec, and ESET noted Lazarus-toolkit overlaps but treated parts of the attribution as tentative.
Lazarus vs. Polish Banks · 01.10.2016
Attacks aimed at banks in Poland appear to be part of a bigger campaign targeting financial organizations around the world, and researchers have found some links to the threat actor known as Lazarus.
Komisja Nadzoru Finansowego · 2016-10
Reported: 2016-10; Victims: Komisja Nadzoru Finansowego; Motivations: Wateringhole; Sectors: Finance; Countries: Poland
Lazarus & Watering-hole attacks (Polish Financial Supervision Authority website, Polish banks) · 12 February 2017 (blog post date, 2017-02-12)
Investigators in Poland have identified known Lazarus group implants on bank networks and associated this with the recent compromise of the Polish Financial Supervision Authority's website. The technical/forensic evidence to link the Lazarus group actors (who we believe are behind the Bangladesh Bank attack and many others in 2016) to the watering-hole activity is unclear.
Lazarus' False Flag Malware (watering-hole attacks on Polish financial institutions and others) · 20 February 2017 (blog post date, 2017-02-20)
Evidently, the Lazarus group are continuing their campaign targeting banking networks.
Watering hole on Polish Financial Supervision Authority website (knf.gov.pl) targeting Polish banks · October 5, 2016 through February 2, 2017 (FBI learned January 2017)
In January 2017, the FBI learned of a malicious cyber campaign that targeted the Polish banking sector and affected multiple victims, including Polish financial institutions. ... The intrusion was likely discovered before the hackers could successfully steal any funds ... the watering hole was likely in place from October 5, 2016 through February 2, 2017. [Case No. 2:18-mj-01479, U.S. District Court for the Central District of California; filing: COMPLAINT filed as to Defendant Park Jin Hyok in violation of 18:371; 18:1349. Approved by Magistrate Judge Rozella A. O]
Polish Financial Supervision Authority website made into watering hole · Beginning in or around October 2016
Overt Act No. 8: Beginning in or around October 2016, the hackers gained unauthorized access to the computer network of the Polish Financial Supervision Authority and made its website into a watering hole. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
Polish Financial Supervision Authority website (watering hole) · 2017
Annex 22, para 2: “In 2017, DPRK cyber actors infected the website of the Polish Financial Supervision Authority with malware programed to only download onto computers which visited the site if they were from 104 pre-selected financial institutions and telecom companies.”