Konrads Klints

There was actually an article in The New Yorker a few years ago profiling the programs in North Korea to elevate the skills of their IT professionals and expose them to foreign markets through participation in various competitions.

2

🌙Moonstone Mayhem🌙 North Korean threat actors, particularly those operating in the newly identified group Moonstone Sleet, continue to exploit the open-source ecosystem, targeting the public npm registry to distribute malicious packages. 📦 These activities, initially linked to the group Jade Sleet, have persisted into 2024 despite increased awareness and defensive efforts. The emergence of Moonstone Sleet demonstrates an ongoing threat to the open-source software supply chain, employing similar tactics to other North Korean groups to achieve financial gains and cyberespionage through malware distributed via npm packages. These malicious activities underscore a persistent cybersecurity threat within the open-source community, challenging both the security infrastructure and the operational integrity of affected systems. 🕵️ The differing techniques between Jade Sleet's dual-package approach and Moonstone Sleet's more streamlined, single-package strategy highlight evolving methods to evade detection and maximize impact. This situation stresses the importance of vigilant security practices among developers and organizations utilizing open-source resources, as well as the necessity for ongoing collaboration within the cybersecurity community to counter these sophisticated threats effectively. 👇 Click the link below to read the full details on the group's activities and tactics, then drop your thoughts in the comments below about this latest threat from North Korea and what it means for the next steps of combatting adversarial state-sponsored groups. #NorthKorea #JadeSleet #MoonstoneSleet #threatactor #statesponsored #cyberespionage #malware #NPM #npmpackages #cybersecurity #nationalsecurity Checkmarx.com https://buff.ly/4cpeqCB

1

In response to a series of high-profile cyber attacks, Indonesia is establishing a new cyber force, Angkatan Siber, though some have raised concerns about inadequate resources. The Straits Times Edbert Centre for Strategic and International Studies (CSIS), Indonesia Badan Siber dan Sandi Negara #cybersecurity #cyberattack #infosec #indonesia

5

1 Comment

Red Alert, an offensive research department that is part of a Singapore NSHC group, released "Monthly Threat Actor Group Intelligence Report" for July 2024. There are a few statistics that caught our eye: - The following industries are the most targeted by threat actors: * Commercial Facilities (16% of all attacks) * Finance (10%) * Government (10%) * Manufacturing (10%) * Research (10%) - The most targeted continent is Europe (25% of all attacks) and at the second place you will find South Asia (21%) - The majority of attacks used various phishing methodologies to infect the endpoint devices with malware, usually disguised as a legitimate file. - The most common goal of hacker groups is data theft. You can find more details here: https://lnkd.in/eD4-ghRP

6

According to recent research, Chinese hacking groups have been targeting a Southeast Asian government agency in a coordinated cyber espionage operation since March 2023. Campaign dubbed "Operation Crimson Palace", involved new malware variants and three activity clusters. Despite Sophos blocking some operations, the attackers have persisted, attempting to resume illicit activities more covertly. Co-founder Francois Driessen weighs in on how this situation reveals the vulnerabilities organizations face when relying purely on reactive security; warranting the need for a true proactive approach. "This is a textbook case of failure of reactive security, no matter how good the technology is," shares Francois. Read the full report here: https://bit.ly/3z3tbMF #ZTconnectivity #CyberEspionage #SophosReport #ThreatGroup

8

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

1

5 EYES ARE "JUST SPIES" SAYS CCP: Volt Typhoon is a China-nexus cyber espionage group that's believed to be active since 2019, stealthily embedding itself into critical infrastructure networks by routing traffic through edge devices compromising routers, firewalls, and VPN hardware in an effort to blend in and "fly under the radar." But the Chinese govt themselves just aren't buying it! Beijing accuses the U.S. federal government, intelligence agencies, and Five Eyes countries of conducting cyber espionage activities against China, and that Volt Typhoon is a United States-based creation of its own. It also said there's "ironclad evidence" indicating that the U.S. carries out false flag operations in an attempt to conceal its own malicious cyber attacks, adding it's inventing the "so-called danger of Chinese cyber attacks" and that it has established a "large-scale global internet surveillance network." Oh, China. Bless your heart. The psychologists would call this "projection." https://lnkd.in/gT9S2qD6 #cybersec #auguryit

23

6 Comments

🔍 Unmasking TA397: The Rising Threat in Cyberespionage 🛡️ In an age where cyber threats are escalating, TA397, also known as "Bitter," has emerged as a formidable player in the realm of espionage. Targeting Turkey's defense sector, their use of sophisticated tactics and tools like WmRAT, MiyaRAT, and Alternate Data Streams highlights the urgent need for advanced cybersecurity measures. In our latest blog, we delve deep into: ✔️ The origins and evolution of TA397. ✔️ Their cutting-edge attack strategies, including spear phishing and malware deployment. ✔️ Broader implications for critical sectors worldwide. Understand why the actions of TA397 are a wake-up call for enhanced global cyber defense. ➡️ Read the full article and stay ahead of the threat landscape: https://lnkd.in/dDfMWkCq Follow 1950.ai for insights from experts like Dr. Shahid Masood and our dedicated team on how cutting-edge technologies are reshaping cybersecurity. #Cybersecurity #AI #CyberThreats #PredictiveAI #APT #TechInnovation #ShahidMasood #DrShahidMasood #1950ai

1

[Data Breach][MY]🔴 Chris Leong In August 2024, the website of Master Chris Leong "a leading Tit Tar practitioner in Malaysia" suffered a data breach. The incident exposed 27k unique email addresses along with names, physical addresses, dates of birth, genders, nationalities and in many cases, links to Facebook profiles. The company did not respond when contacted about the breach. Breach date: 10 August 2024 Date added to HIBP: 13 August 2024 Compromised accounts: 27,096 Compromised data: Dates of birth, Email addresses, Genders, Names, Nationalities, Phone numbers, Physical addresses, Purchases, Social media profiles Date: 13 August 2024 Refer: https://lnkd.in/efdunV4B #rectifyq #cti #threatintel #threatintelligence #malaysia #infosec

2

Indonesia, a nation experiencing rapid technological advancements, is also grappling with a concerning trend – the rise of cybercrime. A recent report by Amnesty International sheds light on this growing issue, urging the Indonesian government to take stricter measures to combat online threats. This article explores the report’s findings, the factors contributing to cybercrime in Indonesia, and steps that can be taken to build a more secure digital future. https://lnkd.in/edp4UYuS

2

The cybersecurity industry puts far too much focus on breach detection rather than prevention. Here we have a state-sponsored cyber group targeting military and nuclear programs, and they are exploiting a set of well known CVEs that really should have been patched a long time ago. This tactic works because a significant number of organisations (including those running our critical national infrastructure) still haven't patched these CVEs. Imagine buying the best burglar alarm money can buy and then never taking the time to close your front door. If you are putting all of your security budget into internal tools without securing your external attack surface then this is exactly what you are doing (and it will never work). NCSC article: https://lnkd.in/eE-fqiyz The joint NCSC, NSA, CISA, CNMF, DC3, NIS and NPA advisory: https://lnkd.in/eJvszdPE

2

🚨 Threat Campaign Alert - North Korea's Kimsuky Unleashes New KLogEXE Keylogger and FPSpy in Targeted Attacks on South Korean🚨 Summary: The North Korean APT group Sparkling Pisces (aka Kimsuky) has been discovered using two new malware strains, KLogEXE and FPSpy, to target South Korea. These sophisticated tools, which include a keylogger and a backdoor, significantly enhance their cyber espionage capabilities and pose a serious threat to global organizations. Threat Actor/Group: Sparkling Pisces (aka Kimsuky)   Malware: KLogEXE, FPSpy Targeted Countries: South Korea Targeted Industries: Not Mentioned Targeted Applications/CVE: Not Mentioned Impact: Espionage, Data exfiltration, keylogging, device compromise IOCs:  SHA-256 Hash 990b7eec4e0d9a22ec0b5c82df535cf1666d9021f2e417b49dc5110a67228e27, a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2, faf666019333f4515f241c1d3fcfc25c67532463245e358b90f9e498fe4f6801, c69cd6a9a09405ae5a60acba2f9770c722afde952bd5a227a72393501b4f5343, 2e768cee1c89ad5fc89be9df5061110d2a4953b336309014e0593eb65c75e715, Domains and Ip Addr mail.apollo-page.r-e[.]kr, nidlogin.apollo.r-e[.]kr, bitjoker2024.000webhostapp[.]com, www.vic.apollo-star7[.]kro.kr 152.32.138[.]167 URL hxxp[:]//mail.apollo-page.r-e[.]kr/wp-content/include.php?_sys_=7, hxxp[:]//mail.apollo-page.r-e[.]kr/plugin/include.php?_sys_=7, hxxps[:]//nidlogin.apollo.r-e[.]kr/cmd/index.php?_idx_=7 MITRE ATT&CK TTP IDs: T1056 (Input Capture),T1071.001 (Application Layer Protocol - Web Protocols),T1105 (Ingress Tool Transfer),T1059.001 (Command and Scripting Interpreter: PowerShell),T1027 (Obfuscated Files or Information) Reference: This writing is based on Research Advisory Report published by ‘Unit42' Team. ------------------------------------------------------------------------------------------ 🚀Join us on our mission to secure the digital world and make cyber defense affordable to everyone! 🌐 Follow "CyberXTron Technologies" for the timely, relevant and actionable cyber threat insights.  #SparklingPisces #Kimsuky #CyberEspionage #Keylogger #FPSpy #APTGroup #NorthKoreaCyberThreat #MalwareAnalysis #CyberThreat #Malware #InfoSec #ThreatIntelligence #cyberXTron #uncovertheunknown🛡️🔒

2

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16