ESET APT Activity Report Q4 2022­–Q1 2023 (DPRK-related paragraph 1)

ESET WeLiveSecurity

North Korea-aligned groups such as ScarCruft, Andariel, and Kimsuky continued to focus on South Korean and South Korea-related entities using their usual toolsets. In addition to targeting the employees of a defense contractor in Poland with a fake Boeing-themed job offer, Lazarus also shifted its focus from its usual target verticals to a data management company in India, utilizing an Accenture-themed lure. Additionally, we also identified a Linux malware being leveraged in one of their campaigns. Russia-aligned APT groups were especially active in Ukraine and EU countries, with Sandworm deploying wipers (including a new one we call SwiftSlicer), and Gamaredon, Sednit, and the Dukes utilizing spearphishing emails that, in the case of the Dukes, led to the execution of a red team implant known as Brute Ratel. Finally, we detected that the previously mentioned Zimbra email platform was also exploited by Winter Vivern, a group particularly active in Europe, and we noted a significant drop in the activity of SturgeonPhisher, a group targeting government staff of Central Asian countries with spearphishing emails, leading to our belief that the group is currently retooling.