Rewterz Threat Alert – A North Korean Threat Actor Group, APT43, Funds Its Espionage Activities Through Cybercrime – Active IOCs

Severity

High

Analysis Summary

Security researchers have discovered another North Korean threat actor gang that uses cybercrime operations to fund espionage activities against South Korean and US government organization.

APT43 threat actor group combines ‘moderately-sophisticated’ technological skills with aggressive social engineering efforts, particularly targeting South Korean and US-based government agencies, academics, and think tanks concentrating on geopolitical concerns on the Korean peninsula. The campaign include strategic intelligence collection linked with Pyongyang’s geopolitical goals, credential harvesting and social engineering to enable espionage efforts, and financially driven cybercrime to fund operations.

APT43’s collecting goals fit with the mission of North Korea’s principal foreign intelligence service, the Reconnaissance General Bureau (RGB), stating that the group’s concentration on foreign policy and nuclear security concerns helps North Korea’s strategic and nuclear aspirations.

The group develops a large number of spoofed and fraudulent personas for use in social engineering, as well as cover identities for acquiring operational gear and infrastructure.

” Domains masquerading as legitimate sites are used in credential harvesting operations.” Also, they added, “We have not observed APT43 exploiting zero-day vulnerabilities.”

APT43 maintains a high tempo of activity, indicating a persistent and ongoing threat to cybersecurity. Their focus on phishing and credential collection campaigns is also worrisome, as these tactics are commonly used to gain unauthorized access to sensitive information and systems.

The report mentions APT43’s coordination with other elements of the North Korean cyber ecosystem is also significant. North Korea is known to have a well-developed cyber program that includes multiple state-sponsored hacking groups, and coordination between these groups could make them even more dangerous and effective in their cyber espionage activities.

In order to support North Korea’s juche state philosophy of self-reliance, APT43 steals and launders enough bitcoin to purchase operational infrastructure, relieving financial pressure on the central government.

Experts believe that APT43’s principal goal is cyber espionage, and the information that is currently accessible suggests that the group also engages in other actions that assist gathering strategic intelligence.

“Although the overall targeting reach is broad, the ultimate aim of campaigns is most likely centered around enabling North Korea’s weapons program, including: collecting information about international negotiations, sanctions policy, and other country’s foreign relations and domestic politics as these may affect North Korea’s nuclear ambitions” they added.

Impact

• Cyber Espionage 
• Cyber Warfare

Indicators of Compromise

MD5

• 982fc9ded34c85469269eacb1cb4ef26
• de9a8c26049699dbbd5d334a8566d38d
• 144bd7fd423edc3965cb0161a8b82ab2
• cd83a51bec0396f4a0fd563ca9c929d7
• 33df74cbb60920d63fe677c6f90b63f9
• ebaf83302dc78d96d5993830430bd169
• b846fa8bc3a55fa0490a807186a8ece9
• f92a75b98249fa61cf62e8b63cb68fae
• e8da7fcdf0ca67b76f9a7967e240d223
• 2bf26702c6ecbd46f68138cdcd45c034

SHA-256

• 557ff6c87c81a2d2348bd8d667ea8412a1a0a055f5e1ae91701c2954ca8a3fdb
• 43c2d5122af50363c29879501776d907eaa568fa142d935f6c80e823d18223f5
• 2b78d5228737a38fa940e9ab19601747c68ed28e488696694648e3d70e53eb5a
• fb7fb6dbaf568b568cd5e60ab537a42d5982949a5e577db53cc707012c7f20e3
• 94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579
• 5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b
• 855656bfecc359a1816437223c4a133359e73ecf45acda667610fbe7875ab3c8
• d0971d098b0f8cf2187feeed3ce049930f19ec3379b141ec6a2f2871b1e90ff7
• 9dac6553b89645ac8d9e0a3dc877d12641e6d05fb52e8de6ae5533b2bdf0abc9
• 38d1d8c3c4ec5ea17c3719af285247cb1d8879c7cf967e1be1197e60d42c01c5

SHA-1

• e205ed81ccb99641dcc6c2799d32ef0584fa2175
• 47a32bc992e5d4613b3658b025ab913b0679232c
• 1087efbd004f65d226bf20a52f1dc0b3e756ff9e
• f3b047e6eb3964deb047767fad52851c5601483f
• 539acd9145befd7e670fe826c248766f46f0d041
• bc6cb78e20cb20285149d55563f6fdcf4aaafa58
• c0c6b99796d732fa53402ff49fd241612a340229
• e5b312155289cdc6a80a041821fc82d2cca80bcd
• b0c2312852d750c4bceb552def6985b8b800d3f3
• 1b9a4c0a5615a4f96a041d771646c1a407b17577

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Implementing strong access controls can help prevent unauthorized access to sensitive information and systems. This includes using multi-factor authentication, regularly changing passwords, and limiting access to information and systems based on job roles and responsibilities.
• Implement Advanced Threat Detection and Response Capabilities: Advanced threat detection and response capabilities, such as intrusion detection systems (IDS) and Security Information and Event Management (SIEM) tools, can help detect and respond to potential cyber attacks in real-time.