North Korean state-sponsored hacking group Lazarus gained access to research facilities and stole information beginning in August 2022 · 22.08.2022
The North Korean state-sponsored hacking group Lazarus gained access to public as well as private research institutions focused on health and energy and stole 100 GB of information for espionage purposes during the period of 22 August and 11 November 2022, the Finnish cybersecurity firm WithSecure concludes with high-confidence.
The hacking group gained initial access to unpatched Zimbra servers via two associated vulnerabilities (CVE-2022-27925 and CVE-2022-37042).
This cyber incident, along with two other cyber incidents from 2022 (Stonefly and Tale of Three RATs), is part of a large cyber campaign to gather sensitive information from targets in highly-specialized sectors.
Sources cited by EuRepoC (18)
Show 13 more
Operation “No Pineapple!” · 2022-08
Operation “No Pineapple!”
North Korean hackers stole research data in two-month-long breach
https://www.bleepingcomputer.com/news/security/north-korean-hackers-stole-research-data-in-two-month-long-breach/
DPRK Using Unpatched Zimbra Devices to Spy on Researchers · 2022 Late
DPRK Using Unpatched Zimbra Devices to Spy on Researchers
https://www.darkreading.com/remote-workforce/dprk-using-unpatched-zimbra-devices-to-spy-on-researchers-
no-pineapple-dprk-targeting-of-medical-research-and-technology-sector · February
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 6 of 75, PDF p. 319). DPRK cyber actor: Lazarus Group; Report Name: no-pineapple-dprk-targeting-of-medical-research-and-technology-sector; Case Summary: The Lazarus Group targeted a manufacturer of technology used in energy, research, defense, and healthcare verticals, and the chemical engineering department of a research university between May and November 2022. The actors attacked an unnamed company that was exploited through CVE-2022-27925 and CVE-2022-37042, two bugs affecting the digital collaboration platform ‘Zimbra’. The attackers used the bugsto gain access to the ‘Zimbra’ mail server, exfiltrating the contents of mailboxes, moved laterally to another vulnerable device on the same network and used malware to eventually steal 100GB of data.; Publication Month: February
“No Pineapple” campaign (Zimbra exploitation; 100 GB stolen) · between May and November 2022
Para 115: “A cybersecurity company informed the Panel in June that, between May and November 2022, the Lazarus Group had been observed targeting a Member State’s public and private sector research organizations, medical research and energy sectors, as well as their supply chains. This campaign, dubbed “No Pineapple”, focused on intelligence-gathering, starting with an attack on a company that was exploited through CVE-2022-27925 (remote code execution) and CVE-2022-37042 (authentication bypass) – two vulnerabilities affecting the digital collaboration platform Zimbra. ... used Dtrack malware, an information-stealing backdoor, to eventually steal 100 GB of data.”