North Korean state-sponsored hacker group ZINC compromises various organizations in the United States, the United Kingdom, India and Russia since late April 2022 · 01.04.2022
North Korean state-sponsored hacker group ZINC compromises organizations in various fields - like media, defense, aerospace and IT services - in the United States, the United Kingdom, India and Russia in order to exfiltrate information from late April to mid-September 2022, according to a technical report of Microsoft. The initiators used open-source software like PuTTY, KiTTY, TightVNC Viewer, Sumatra PDF Reader and muPDF/Subliminal Recording.
This cyber incident is part of a broader campaign of North Korean state-sponsored Lazarus Group, whom ZINC belongs to, which is still ongoing, according to a technical report of Mandiant a month ago.
ZINC weaponizing open-source software · 2022-06
ZINC weaponizing open-source software
https://www.microsoft.com/en-us/security/blog/2022/09/29/zinc-weaponizing-open-source-software/
Multiple organizations · 29/09/2022
Researchers from Microsoft reveal that the North Korean-sponsored Lazarus threat group is trojanizing legitimate open-source software (such as PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, and the muPDF/Subliminal Recording software installer. and using it to backdoor organizations in many industry sectors, such as technology, defense, and media entertainment using the BLINDINGCAN (aka ZetaNile) backdoor. [Date Occurred: In recent months; Date Discovered: In recent months]
ZINC weaponizing open-source software · September
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 26 of 37). RGB Unit: Lazarus Group; Case Name: ZINC weaponizing open-source software; SPH √; KAC √; VAS: (blank); Publicized Month: September. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
ZINC weaponized open-source applications (PuTTY, KiTTY, TightVNC, Sumatra PDF) via LinkedIn and WhatsApp
Para 142: “According to a cybersecurity section of an information technology company, the Lazarus Group (also known as ZINC) has been targeting engineers and technical support employees using malicious versions of open-source applications, including PuTTY, KiTTY, TightVNC and Sumatra PDF readers. Malicious social engineering campaigns with objectives focused on espionage and data theft were conducted by ZINC. These campaigns targeted employees in organizations across various industries, including defence and aerospace in multiple Member States. Initial contacts with individuals were made via LinkedIn, and once a level of trust with the targets was established, malicious payloads were delivered through continued communications over WhatsApp.”
ZINC weaponizing open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, muPDF/Subliminal Recording) via LinkedIn/WhatsApp · 2022-09-29T16:00:00+00:00 (published_time)
Microsoft Threat Intelligence Center (MSTIC) observed activity targeting employees in organizations across multiple industries including media, defense and aerospace, and IT services in the US, UK, India, and Russia. Based on the observed tradecraft, infrastructure, tooling, and account affiliations, MSTIC attributes this campaign with high confidence to ZINC, a state-sponsored group based out of North Korea ... Beginning in June 2022, ZINC employed traditional social engineering tactics by initially connecting with individuals on LinkedIn ... The actors have successfully compromised numerous organizations since June 2022.