Operation North Star – North-Korea hackers targeted US defense and aerospace companies

North Korea-linked hackers continue to be very active in this period, researchers reported a campaign aimed at the US defense and aerospace sectors.

Security experts from McAfee uncovered a new cyber-espionage campaign carried out by North Korean hackers that targeted the US defense and aerospace sectors. Threat actors used fake job offers to deceive employees looking for new job opportunities and compromise the network of their organizations.

The campaign tracked ‘Operation North Star,’ was active between late March and May 2020.

The threat actors’ job postings messages were crafted to target the following specific US defense programs and groups:

F-22 Fighter Jet ProgramDefense, Space and Security (DSS)Photovoltaics for space solar cellsAeronautics Integrated Fighter GroupMilitary aircraft modernization programs

The researchers noticed that the infrastructure and TTPs (Techniques, Tactics, and Procedures) used in this campaign overlaps with the ones previously associated with Hidden Cobra.

The attackers sent out spear-phishing emails using boobytrapped documents leveraging the fake job offer as bait.

Threat actors behind this campaign are utilizing compromised infrastructure from multiple European countries to host their C2 infrastructure and distribute the malware to the targets.

The Techniques, Tactics, and Procedures (TTPs) of the Operation North Star operations are very similar to those observed in 2017 and 2019 campaigns that targeted key military and defense technologies.

“Our analysis indicates that one of the purposes of the activity in 2020 was to install data gathering implants on victims’ machines. These DLL implants were intended to gather basic information from the victims’ machines with the purpose of victim identification.” states the report published by the experts. “The data collected from the target machine could be useful in classifying the value of the target. McAfee ATR noticed several different types of implants were used by the adversary in the 2020 campaigns.”

It is not clear how efficient was a “new job” theme campaign due to the ongoing Coronavirus pandemic.

Recently, security experts from Kaspersky Lab reported that North Korea-linked hackers are attempting to spread a new ransomware strain known as VHD.

In a separate report, Kaspersky also reported that Lazarus APT Group has used a new multi-platform malware framework, dubbed MATA, to target entities worldwide,

Pierluigi Paganini

(SecurityAffairs – hacking, North Korea)

---