CSIS entry 353

CSIS Significant Cyber Incidents

A North Korea-linked hacking campaign using phishing emails sent from fake job recruiters targeted chemical companies in South Korea.

EuRepoC

According to Symantec, the North Korean APT group Lazarus has conducted a cyberespionage operation that targets the chemical sector in South Korea. It is assessed as a continuation of the group's Operation Dream Job Campaign, which first began in August 2020 and continued to evolve over the next few years. The Operation Dream Job is known for utilizing inauthentic job offers containing malicious links or attachments that install malware for cyberespionage purposes. The attack starts with a malicious HTM file which is copied to a DLL file (called scskapplink.dll) and then "injected into the legitimate system management software INISAFE Web EX Client." Google research identified two North Korean campaigns that exploited zero-day vulnerabilities (CVE-2022-0609), one of which was Operation Dream Job (the other being Operation AppleJeus). Symantec found evidence that supported this fact and that this activity, dubbed "Pompilus", is a continuation of this hacking campaign based on file hashes, file names, and tools that were observed in previous Dream Job campaigns. Further investigation by Symantec revealed that the Lazarus group's tactics have evolved to include sophisticated methods for maintaining persistence and evading detection in the targeted networks. The cyberespionage campaign is part of a broader effort by the Lazarus group to gather sensitive information and intellectual property from the chemical sector, likely to advance North Korea's strategic and economic objectives in this field.

ThaiCERT Threat Group Cards

Lazarus Targets Chemical Sector https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Researchers from Symantec Broadcom reveal that the Operation Dream Job has now been expanded to target chemical and IT sector organizations in South Korea.

CFR Cyber Operations Tracker

campaign, North Korea’s Lazarus Group targeted individuals working at chemical sector organizations in South Korea. Lazarus used fake job-themed lures to bait victims into opening a malicious link and downloading malware used for cyber espionage.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Symantec Broadcom reveal that the Operation Dream Job has now been expanded to target chemical and IT sector organizations in South Korea. [Date Occurred: 'Recently'; Date Discovered: 'Recently']

UN Panel of Experts S/2022/668

Para 125: “The Panel received information that a Lazarus Group campaign in January 2022 focused on multiple chemical and IT sector organizations to obtain intellectual property to further the interest of the Democratic People’s Republic of Korea in these areas. A report from a cybersecurity firm reveals that this was a continuation of Lazarus Group’s “Operation Dream Job”, which used fake job offers to lure victims into clicking on links or attachments that eventually installed malware.”

Symantec / Broadcom Threat Hunter Team (security.com)

Continuation of Operation Dream Job sees North Korea-linked APT target orgs in espionage campaign.

North Korea's Lazarus Group targeted individuals working at chemical sector organizations in South Korea.

In an extension of its Operation Dream Job campaign, North Korea's Lazarus Group targeted individuals working at chemical sector organizations in South Korea.