EuRepoC
North Korean state-sponsored hacking group Labyrinth Chollima gained access to network of unnamed Latin American banking company using QRLOG malware beginning in January 2023 · 01.01.2023
The North Korean state-sponsored hacking group Labyrinth Chollima gained access to the network of an unnamed Latin American banking company using the previously undocumented QRLOG malware during January to February 2023, the Argentinian newspaper Clarin reported on 28 July 2023. According to the report, the affected banking company discovered unusual behaviour in its network in February 2023 and isolated the infected machine. Mauro Eldritch, a threat analyst at Birmingham Cyber Arms, identified the deployed malware as a remote access Trojan (RAT) that poses as QR code generator for the authentication of online payments to steal money from victims. Following the identification of the malware, Eldritch contacted a colleague at the US IT security company Crowdstrike to determine the authorship of the malware. Crowdstrike analysts concluded with a high degree of confidence that Labyrinth Chollima infected the Latin American banking company. In addition, Crowdstrike determined the North Korean hackers had operated undetected within the bank's network for a month.