North Korean Lazarus Group hijacked media companies with a trojanized PuTTY utility in 2022 · 01.06.2022
North Korean Lazarus Group hijacked media companies with a trojanized PuTTY utility, that led to the deployment of the AIRDRY.V2 backdoor, since June 2022, according to a technical report by Mandiant.
The IT-company Mandiant further states that this is an extention of Operation Dream Job, in which state-sponsored North Korean hacking group Lazarus targeted especially Israeli entities in the government and defense sector.
Sources cited by EuRepoC (7)
Show 2 more
Company in the media industry · 14/09/2022
Researchers from Mandiant reveal that North Korean hackers are using trojanized versions of the PuTTY SSH client to deploy backdoors on targets' devices as part of a fake Amazon job assessment. [Date Occurred: During July 2022; Date Discovered: During July 2022]
UNC4034 job opportunity phishing via WhatsApp with trojanized PuTTY (AIRDRY.V2) at a media company · 2022-09-14 (datePublished)
In July 2022, during proactive threat hunting activities at a company in the media industry, Mandiant Managed Defense identified a novel spear phish methodology employed by the threat cluster tracked as UNC4034. Mandiant has identified several overlaps between this group and those we suspect have a North Korea nexus. ... UNC4034 established communication with the victim over WhatsApp and lured them to download a malicious ISO package regarding a fake job offering that led to the deployment of the AIRDRY.V2 backdoor through a trojanized instance of the PuTTY utility.