DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Financially-motivated hacker group BlueNoroff compromised a company employee in the United Arab Emirates beginning in September 2022

Date (as written)
02.09.2022
Year
2022
Country
United Arab Emirates
Actors (as written)
Blue Noroff/APT38/Stardust Chollima/G0082/Sapphire Sleet fka COPERNICUM/Genie Spider < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
Actor pages
Blue NoroffAPT38Stardust ChollimaG0082Sapphire Sleet fka COPERNICUMGenie Spider < Lazarus GroupLabyrinth ChollimaHIDDEN COBRAGuardians of PeaceDiamond Sleet fka ZINCNICKEL ACADEMYNewRomanic Cyber Army TeamWhois Hacking TeamApplewormGroup 77G0032
Tags (as written)
Hijacking without Misuse

Source entries (1)

EuRepoC

Financially-motivated hacker group BlueNoroff compromised a company employee in the United Arab Emirates beginning in September 2022 · 02.09.2022
Financially-motivated hacker group BlueNoroff compromised an employee in the sales department of a home financing company with likely Japan connections in the United Arab Emirates beginning on 2 September 2022, according to IT security company Kaspersky. BlueNoroff is known to be a subgroup of the notorious state-sponsored hacking group Lazarus. What stands out in this cyber incident is the circumvention of the Mark-of-the-Web flag by using different file types. Kaspersky claims with low confidence that the hacker group is interested in Japanese-related targets due to the Japanese spoofing websites and file names.
Sources cited by EuRepoC (6)
https://thehackernews.com/2022/12/bluenoroff-apt-hackers-using-new-ways.html
https://securelist.com/bluenoroff-methods-bypass-motw/108383/
https://www.securityweek.com/north-korean-hackers-created-70-fake-bank-venture-capital-firm-domains
https://twitter.com/Dinosn/status/1608173665547583488
https://twitter.com/obiwan666/status/1608181359079743488
Show 1 more
https://thehackernews.com/2023/08/north-korean-hackers-deploy-new.html

Suggest a correction on GitHub