Andariel Group attacks website of South Korean non-profit organisation

Date (as written): 01.06.2018
Year: 2018
Country: Korea, Republic of;Korea, Republic of
Actors (as written): Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
Actor pages: Andariel APT45 Onyx Sleet fka PLUTONIUM Silent Chollima Stonefly G0138 DarkSeoul < Lazarus Group Labyrinth Chollima HIDDEN COBRA Guardians of Peace Diamond Sleet fka ZINC NICKEL ACADEMY NewRomanic Cyber Army Team Whois Hacking Team Appleworm Group 77 G0032 Lazarus Group
Tags (as written): Data theft

Source entries (4)

EuRepoC

Andariel Group attacks website of South Korean non-profit organisation · 01.06.2018

Researchers from Trend Micro discover a new campaign from the Andariel Group carried out via the injection of a malicious script into four compromised South Korean websites for reconnaissance purposes.

https://blog.trendmicro.com/trendlabs-security-intelligence/new-andariel-reconnaissance-tactics-hint-at-next-targets/

Hackmageddon cyber attacks timelines (Paolo Passeri)

South Korean targets · 16/07/2018

Researchers from Trend Micro discover a new campaign from the Andariel Group carried out via the injection of a malicious script into four compromised South Korean websites for reconnaissance purposes.

https://www.hackmageddon.com/2018/09/06/16-31-july-cyber-attacks-timeline-2/

https://blog.trendmicro.com/trendlabs-security-intelligence/new-andariel-reconnaissance-tactics-hint-at-next-targets/

ZDNet Korea (zdnet.co.kr)

"북한 배후 해커그룹 안다리엘, 잠재 공격 대상 확대" · 2018-07-20

attribution sentence(s): 북한 배후 해커조직으로 추정되는 안다리엘(Andariel)이 새로운 한국 대상 정찰 기법을 동원해 공격을 준비 중인 것으로 파악됐다. | 연구원들의 분석에 따르면 안다리엘은 과거 수년간 한국 정부 및 금융사 웹사이트에 사용되는 액티브X 모듈 취약점을 악용해 사이버 공격을 해왔다. | 20일 트렌드마이크로는 안다리엘을 추적하고 있는 연구그룹 '이슈메이커스랩'과 협력해 "안다리엘이 국내 소프트웨어(SW) 개발업체의 액티브X(ActiveX) 및 음성변환 솔루션의 취약점을 파악하고 향후 공격을 준비하는 '정찰' 활동을 벌였음을 파악했다고 밝혔다.

https://zdnet.co.kr/view/?no=20180719102416

Trend Micro Research

New Andariel Reconnaissance Tactics Uncovered · 2018-07-16

Some groups go to great lengths to investigate their targets

https://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html

Suggest a correction on GitHub