14th August – Threat Intelligence Report · 2023-08-14
Researchers have discovered an intrusion into a Russian missile engineering organization, NPO Mashinostroyeniya. Within this organization, they identified two instances of North Korea-related compromise of sensitive internal IT infrastructure, which included an email server, and the use of a Windows backdoor called OpenCarrot.
NPO Mashinostroyeniya · 07/08/2023
Researchers from Sentinel One reveal that the North Korean threat group ScarCruft hacked the IT infrastructure and email server for NPO Mashinostroyeniya, a Russian space rocket designer and intercontinental ballistic missile engineering organization using a Windows backdoor named 'OpenCarrot'.
comrades-in-arms-north-korea-compromises-sanctioned-russian-missile-engineering-company/ · August
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 34 of 75, PDF p. 325). DPRK cyber actor: Lazarus; Report Name: comrades-in-arms-north-korea-compromises-sanctioned-russian-missile-engineering-company/; Case Summary: The Lazarus Group compromised internal IT infrastructure of NPO Mashinostroyenia, a Russian defense sector company, likely between late 2021 and May 2022. A DLL file, an OpenCarrot Windows OS backdoor used by the Lazarus Group, was identified on multiple internal NPO Mash networks.; Publication Month: August
The Week in Security item: Russian rocket bureau faces cyber-espionage breach; North Korea responsible (Dark Reading) · 2023-08-10T05:00:00.000Z
Cyber-espionage teams linked to the North Korean government — ScarCruft and Lazarus — recently installed digital backdoors into the systems at a rocket design bureau located in Russia.