ThreatNeedle: Defense Industries

CSIS Significant Cyber Incidents

North Korean hackers targeted defense firms in more than a dozen countries in an espionage campaign starting in early 2020.

EuRepoC

Since early 2020 Lazarus has attacked defense industries using a custom backdoor named ThreatNeedle.

ThaiCERT Threat Group Cards

Lazarus targets defense industry with ThreatNeedle https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Lazarus-targets-defense-industry-with-Threatneedle-En.pdf

CFR Cyber Operations Tracker

North Korean APT Lazarus Group used a custom backdoor dubbed ThreatNeedle to laterally move through infected defense firm networks and gather sensitive information in over a dozen countries. The actor achieved initial entry to victim networks through spear-phishing emails with malicious attachments or links.

Check Point Research

Researchers have investigated a campaign by the North Korean APT Lazarus that leveraged the ThreatNeedle malware family to target defense industry entities. The campaign uses Covid-19 themes in spear-phishing emails in addition to tailored personal information.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Kaspersky researchers identify a previously unknown campaign from Lazarus. Since early 2020, the group has been targeting the defense industry with a custom backdoor dubbed ThreatNeedle. [Date Occurred: Since 2020; Date Discovered: –]

ESTsecurity 알약 블로그 (blog.alyac.co.kr)

summary: North Korean hackers target defense industry with custom malware 북한의 해킹 그룹이 민감 정보를 수집하는 것을 목표로 2020년 초부터 ThreatNeedle이라는 커스텀 백도어 악성코드를 이용하여 방위 산업체를 노리고 있는 것으로 나타났습니다. 이 스파잉 캠페인은 약 12개국 이상의 조직에 영향을 미쳤으며, 북한 정부의 지원을 받는 해커의 작업인 것으로 나타났습니다. 공격자는 회사의 기업 네트워크에 침투하기 위한 초기 액세스 벡터로 코로나19를 주제로 한 악성 첨부파일 또는 링크를 포함한 스피어 피싱 이메일을 사용합니다. 초기 해킹 이후, 이들은 2018년 가상화폐 비즈니스를 노린 공격에 처음 사용된 그룹의 커스텀 ThreatNeedle 백도어 악성코.. | attribution sentence: .” <이미지 출처 : https://ics-cert.kaspersky.com/reports/2021/02/25/lazarus-targets-defense-industry-with-threatneedle/> < 공격 흐름 > ThreatNeedle 은 라자루스 해커가 해당 방위산업체 조직의 네트워크에서 측면 이동하여 민감 정보를 수집해 이를 공격자의 서버로 유출시키도록 도왔습니다 | target sentence: 초기 해킹 이후 , 이들은 2018 년 가상화폐 비즈니스를 노린 공격에 처음 사용된 그룹의 커스텀 ThreatNeedle 백도어 악성코드를 설치했습니다

Boannews 보안뉴스 (boannews.com)

attribution sentence(s): 몇 년 동안 돈 훔치는 데 주력했던 라자루스가 변덕을 부리기 시작했다. | [보안뉴스 문가용 기자] 보안 업체 카스퍼스키(Kaspersky)가 북한 라자루스와 관련하여 새로운 사실을 발표했다. | 라자루스가 10개국이 넘는 곳의 국방 업체들의 네트워크에 침투해 민감한 데이터를 대량으로 훔쳐냈다는 것이다.

UN Panel of Experts S/2021/777

Para 154: “Other media reports stated that the Lazarus Group and the Kimsuky Group, another cyberthreat actor closely linked to the Reconnaissance General Bureau, had conducted cyberattacks against Russian defence, energy and information technology sectors in 2020 – a cybercampaign called “ThreatNeedle”. The Panel has made enquiries on these incidents.” Footnote 94: “An affected Member State informed the Panel that an investigation was under way”. Annex 59: excerpt from Kaspersky report on the cyberattacks against the Russian defence industry (https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Lazarus-targets-defense-industry-with-Threatneedle-En.pdf).

Kaspersky Securelist

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Suspected victims: Defense firms in more than a dozen countries

North Korean APT Lazarus Group used a custom backdoor dubbed ThreatNeedle to laterally move through infected defense firm networks