CSIS entry 850 · April 2018
Cyber security researchers reveal that North Korean hackers targeted critical infrastructure, finance, healthcare, and other industries in 17 countries using malware resembling the code used in the 2014 Sony Pictures attack.
Operation “GhostSecret” · 2018-04
Operation “GhostSecret”
Target: The impacted organizations are in industries such as telecommunications, health, finance, critical infrastructure, and entertainment.
Method: Spear-phishing with Destover-like implant.
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/
Operation GhostSecret · Apr 2018
A threat actor targets critical infrastructure and organizations in the entertainment, finance, health-care, education, and telecommunications sectors.
Operation GhostSecret · Apr 24, 2018
This campaign, dubbed Operation GhostSecret, leverages multiple implants, tools, and malware variants associated with the state-sponsored cyber group Hidden Cobra. [...] we can assert with high confidence that this is the work of the Hidden Cobra group. The Advanced Threat Research team uncovered activity related to this campaign in March 2018, when the actors targeted Turkish banks.
Global Malware Campaign Pilfers Data from Multiple Industries (Operation GhostSecret overview) · Apr 24, 2018
This campaign, dubbed Operation GhostSecret, leverages multiple implants, tools, and malware variants associated with the state-sponsored cyber group Hidden Cobra.
country: 17 countries including the United States, the United Kingdom, Germany, Japan, Russia
It is known that 17 countries including the United States, the United Kingdom, Germany, Japan, Russia are targeted only by a short period study of 4 days.
country: 17 countries including the United States, the United Kingdom, Germany, Japan, Russia
It is known that 17 countries including the United States, the United Kingdom, Germany, Japan, Russia are targeted only by a short period study of 4 days.
actors: Hidden Cobra (a.k.a. the Lazarus Group )
the server has the same IP address as the one used in the infamous 2014 Sony Pictures hack , known to be linked to Hidden Cobra (a.k.a. the Lazarus Group ) and North Korea.