Lazarus Group is a cybercrime group made up of an unknown number of individuals. While not much is known about the Lazarus Group, researchers have attributed many cyberattacks to them over the last decade. Originally a criminal group, the group has now been designated as an advanced persistent threat due to intended nature, threat, and wide array of methods used when conducting an operation. Names given by cybersecurity firms include HIDDEN COBRA and Zinc.
History
The earliest known attack that the group is responsible for is known as "Operation Troy", which took place from 2009–2012. This was a cyber-espionage campaign that utilized unsophisticated distributed denial-of-service attack techniques to target the South Korean government in Seoul. They are also responsible for attacks in 2011 and 2013. It is possible that they were also behind a 2007 attack targeting South Korea, but that is still uncertain. A notable attack that the group is known for is the 2014 attack on Sony Pictures. The Sony attack used more sophisticated techniques and highlighted how advanced the group has become over time. The Lazarus Group were reported to have stolen US$ 12 million from the Banco del Austro in Ecuador and US$ 1 million from Vietnam's Tien Phong Bank in 2015. They have also targeted banks in Poland and Mexico. The 2016 bank heist included an attack on the Bangladesh Bank, successfully stealing US$ 81 million and was attributed to the group. In 2017, the Lazarus group was reported to have stolen US$ 60 million from the Far Eastern International Bank of Taiwan although the actual amount stolen was unclear and most of the funds were recovered. It is not clear who is really behind the group, but media reports have suggested the group has links to North Korea. Kaspersky Lab reported in 2017 that Lazarus tended to concentrate on spying and infiltration cyberattacks whereas a sub-group within their organisation, which Kaspersky called Bluenoroff, specialised in financial cyberattacks. Kaspersky found multiple attacks worldwide and a direct link between Bluenoroff and North Korea. However, Kaspersky also acknowledged that the repetition of the code could be a “false flag” meant to mislead investigators and pin the attack on North Korea, given that the worldwide WannaCry worm cyber attack copied techniques from the NSA as well. This ransomware leverages an NSA exploit known as EternalBlue that a hacker group known as Shadow Brokers made public in April 2017. Symantec reported in 2017 that it was "highly likely" that Lazarus was behind the WannaCry attack.
2009 Operation Troy
The next incident took place on July 4, 2009 and sparked the beginning of "Operation Troy." This attack utilized the Mydoom and Dozer malware to launch a large-scale, but quite unsophisticated, DDoS attack against US and South Korean websites. The volley of attacks struck about three dozen websites and placed the text "Memory of Independence Day" in the master boot record.
2013 South Korea Cyberattack
Over time, attacks from this group have grown more sophisticated; their techniques and tools have become better developed and more effective. The March 2011 attack known as "Ten Days of Rain" targeted South Korean media, financial, and critical infrastructure, and consisted of more sophisticated DDoS attacks that originated from compromised computers within South Korea. The attacks continued on March 20, 2013 with DarkSeoul, a wiper attack that targeted three South Korean broadcast companies, financial institutes, and an ISP. At the time, two other groups going by the personas ″NewRomanic Cyber Army Team and WhoIs Team″, took credit for that attack but researchers did not know the Lazarus Group was behind it at the time. Researchers today know the Lazarus Group as a supergroup behind the disruptive attacks.
Late 2014: Sony breach
The Lazarus Group attacks culminated on November 24, 2014. On that day, a Reddit post appeared stating that Sony Pictureshad been hacked. No one knew it at the time, but this was the start to one of the biggest corporate breaches in recent history. At the time of the attack, the group identified themselves as the Guardians of Peace and they were able to hack their way into the Sony network, leaving it crippled for days. The group claims that they were in the Sony network for a year before they were discovered. The attack was so intrusive that the hackers were able to get access to valuable insider information including previously unreleased films and the personal information of approximately 4,000 past and present employees. The group was also able to access internal emails and reveal some very speculative practices going on at Sony.
Early 2016 Investigation: Operation Blockbuster
Under the name ″Operation Blockbuster″, a coalition of security companies, led by Novetta, was able to analyse malware samples found in different cyber-security incidents. Using that data, the team was able to analyse the methods used by the hackers. They linked the Lazarus Group to a number of attacks through a pattern of code re-usage.
The WannaCry malware that affected as many as 300,000 computers worldwide are likely authored by hackers from southern China, Hong Kong, Taiwan or Singapore, said a US intelligence company. The president of Microsoft attributed the WannaCry attack to North Korea.
2017 cryptocurrency attacks
In 2018, Recorded Future issued a report linking the Lazarus Group to attacks on cryptocurrency Bitcoin and Monero users mostly in South Korea. These attacks were reported to be technically similar to previous attacks using the WannaCry ransomware and the attacks on Sony Pictures. One of the tactics used by Lazarus hackers was to exploit vulnerabilities in Hancom's Hangul, a South Korean word processing software. Another tactic was to use spear-phishing lures containing malware and which were sent to South Korean students and users of cryptocurrency exchanges like Coinlink. If the user opened the malware it stole email addresses and passwords. Coinlink denied their site or users emails and passwords had been hacked. The report concluded that “This late-2017 campaign is a continuation of North Korea’s interest in cryptocurrency, which we now know encompasses a broad range of activities including mining, ransomware, and outright theft...” The report also said that North Korea was using these cryptocurrency attacks to get round international financial sanctions. North Korean hackers stole US$ 7 million from Bithumb, a South Korean exchange in February 2017. Youbit, another South Korean Bitcoin exchange company, filed for bankruptcy in December 2017 after 17% of its assets were stolen by cyberattacks following an earlier attack in April 2017. Lazarus and North Korean hackers were blamed for the attacks. Nicehash, a cryptocurrency cloud mining marketplace lost over 4,500 Bitcoin in December 2017. An update about the investigations claimed that the attack is linked to Lazarus Group.
September 2019 attacks
In mid-September 2019, the USA issued a public alert about a new version of malware dubbed ELECTRICFISH. Since the beginning of 2019, North Korean agents have attempted five major cyber-thefts world-wide, including a successful $49 million theft from an institution in Kuwait.
Education
North Korean hackers are sent vocationally to Shenyang, China for special training. They are trained to deploy malware of all types onto computers, computer networks, and servers. Education domestically includes the Kim Chaek University of Technology and Kim Il-sung University.
Units
Lazarus is believed to have two units
BlueNorOff
BlueNorOff is a financially motivated group that is responsible for the illegal transfers of money via forging orders from Swift. BlueNorOff is also called APT38 and Stardust Chollima.
AndAriel
AndAriel is logistically characterized by its targeting on South Korea. AndAriel's alternative name is called Silent Chollima due to the stealthy nature of the subgroup. Any organization in South Korea is vulnerable to AndAriel. Targets include government and defense and any economic symbol.
External Links
https://www.justice.gov/opa/press-release/file/1092091/download Indictment of Park Jin Hyok
