North Korean Hackers Target Journalists With Malware

Share post:

The state-sponsored North Korean hackers APT37, also known as Ricochet Chollima, target journalists with Goldbackdoor malware.

According to NK News, the malicious software spreads through phishing attacks. Emails to journalists included a link to download ZIP archives of LNK files, both named ‘Kang Min-chol edits.’ Kang Min-chol is North Korea’s Minister of Mining Industries.

The Goldbackdoor malware runs as a PE file (portable executable) and can remotely accept basic commands and exfiltrate data. It also has a number of API keys that can be used to authenticate to Azure and recover commands to execute.

To exfiltrate files, the malware uses legitimate cloud services such as Google Drive and Microsoft OneDrive. Files targeted by the malware are mainly documents and media such as PDF, DOCX, MP3, TXT, M4A, JPC, XLS, PPT, BIN, 3GP and MSG.

The campaign uses a two-stage infection process that gave the threat actors more deployment versatility. It also made it harder for analysts to capture payloads.

The sources for this piece include an article in BleepingComputer.

SUBSCRIBE NOW

Related articles

Sleeper Supply Chain Attack Activates After 6 Years

A coordinated supply chain attack has compromised between 500 and 1,000 e-commerce websites by exploiting vulnerabilities in 21...

Russian-Controlled Open Source Tool Raises Alarms Over U.S. Cybersecurity

A widely used open-source Go library, easyjson, used in healthcare, finance and even defence has come under scrutiny...

Signal Archiving Tool Used By Trump Admin Is Breached, Raising Alarms Over Messaging Security (EDITORIAL)

(EDITORIAL) A messaging tool used by Trump administration officials to archive encrypted Signal messages has been hacked —...

Anthropic Warns: AI “Virtual Employees” Could Pose Security Risks Within a Year

Anthropic, a leading artificial intelligence company, anticipates that AI-powered virtual employees could begin operating within corporate networks as...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways