US Financial Instituions · 2022-12-27
BlueNoroff has been blamed for numerous cyberattacks targeting banks and cryptocurrency firms as a part of larger malware campaign aimed against the financial institutions of numerous nations.
Japanese Financial Institutions · 2022-12-27
BlueNoroff has been blamed for numerous cyberattacks targeting banks and cryptocurrency firms as a part of larger malware campaign aimed against the financial institutions of numerous nations.
Vietnamese Financial Instituions · 2022-12-27
BlueNoroff has been blamed for numerous cyberattacks targeting banks and cryptocurrency firms as a part of larger malware campaign aimed against the financial institutions of numerous nations.
UAE Financial Instituions · 2022-12-27
BlueNoroff has been blamed for numerous cyberattacks targeting banks and cryptocurrency firms as a part of larger malware campaign aimed against the financial institutions of numerous nations.
Attacks bypassing MotW · December
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel. RGB Unit: BlueNoroff; Case Name: Attacks bypassing MotW; SPH √; VAS √; VAS Value: N/A; Publicized Month: December. (SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures)
Financial organizations in Japan, UAE, US and Vietnam · 27/12/2022
Researchers from Kaspersky discover a new campaign by the North Korean group BlueNoroff targeting banks and venture capital firms with a new malware arsenal. [Date Occurred: Since at least October 2022; Date Discovered: October 2022]
bluenoroff-methods-bypass-motw/108383/ · December
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 70 of 75, PDF p. 331). DPRK cyber actor: BlueNoroff; Report Name: bluenoroff-methods-bypass-motw/108383/; Case Summary: New BlueNoroff malware was identified inside a ZIP archive that contained a PDF file named “Crypto-assets an d their risks for financial stability.”; Publication Month: December
BlueNoroff phishing bypassing Mark-of-the-Web; fake bank and venture capital domains
Para 168: “BlueNoroff, known as a subgroup of Lazarus, was observed by a cybersecurity company renewing attacks that use new malware and updated delivery techniques, including new file types and a method of bypassing Microsoft’s Mark-of-the-Web (MotW) protections. ... The company assessed that, through phishing, BlueNoroff attempted to infect target organizations in order to intercept cryptocurrency transfers and drain accounts. In addition, as part of the campaign, the hacking group registered fake domains mimicking well-known banks and venture capital firms.”
BlueNoroff introduces new methods bypassing MoTW · 2022-12-27T08:00:26
We continue to track the BlueNoroff group’s activities and this October we observed the adoption of new malware strains in its arsenal.