Kaspersky Lab has published the results of its more-than-year-long investigation into the activity of Lazarus – a notorious hacking group allegedly responsible for the theft of 81 million dollars from the Central Bank of Bangladesh in 2016.
During the forensic analysis of artefacts left by the group in South-East Asian and European banks, Kaspersky Lab has reached a deep understanding of what malicious tools the group uses and how it operates while attacking financial institutions, casinos, software developers for investment companies and crypto-currency businesses around the world. This knowledge has helped to interrupt at least two other operations which had one goal – to steal a large amount of money from financial institutions.
In February 2016, a group of hackers (unidentified at that time) attempted to steal $851 million USD, and managed to transfer 81 million USD from the Central Bank of Bangladesh. This is considered to be one of the largest, most successful cyber heists ever. Further investigation conducted by researchers from different IT security companies including Kaspersky Lab revealed a high chance that the attacks were conducted by Lazarus – a notorious cyber espionage and sabotage group responsible for a series of regular and devastating attacks, and known for attacking manufacturing companies, media and financial institutions in at least 18 countries around the world since 2009.
Although several months of silence followed the Bangladesh attack, the Lazarus group was still active. They had been preparing for a new operation to steal money from other banks and, by the time they were ready, they already had their foot in a financial institution in South East Asia. After being interrupted by Kaspersky Lab products and the following investigation, they were set back for another few months, and later decided to change their operation by moving to Europe. But here too, their attempts were interrupted by Kaspersky Lab’s security software detections, as well as the quick incident response, forensic analysis, and reverse engineering with support from company’s top researchers.
Based on the results of the forensic analysis of these attacks, Kaspersky Lab researchers were able to reconstruct the modus operandi of the group.
Initial compromise: A single system inside a bank is breached either with remotely accessible vulnerable code (i.e. on a webserver) or through a watering hole attack through an exploit planted on a benign website. Once such a site is visited, the victim’s (bank employee) computer gets malware, which brings additional components.
Foothold established: Then the group migrates to other bank hosts and deploys persistent backdoors – the malware allows them to come and go whenever they want.
Internal reconnaissance: Subsequently the group spends days and weeks learning the network, and identifying valuable resources. One such resource may be a backup server, where authentication information is stored, a mail server or the whole domain controller with keys to every “door” in the company, as well as servers storing or processing records of financial transactions.
Deliver and steal: Finally, they deploy special malware capable of bypassing the internal security features of financial software and issuing rogue transactions on behalf of the bank.
Geography and Attribution
The attacks investigated by Kaspersky Lab researchers lasted for weeks. However, the attackers could operate under the radar for months. For example, during the analysis of the incident in South-East Asia, experts discovered that hackers were able to compromise the bank network no less than seven months prior to the day when the bank’s security team requested incident response. In fact, the group had access to the network of that bank even before the day of the Bangladesh incident.
According to Kaspersky Lab records, from December 2015, malware samples relating to Lazarus group activity appeared in financial institutions, casinos software developers for investment companies and crypto-currency businesses in Korea, Bangladesh, India, Vietnam, Indonesia, Costa Rica, Malaysia, Poland, Iraq, Ethiopia, Kenya, Nigeria, Uruguay, Gabon, Thailand and several other countries. The latest samples known to Kaspersky Lab were detected in March 2017, showing that attackers have no intention of stopping.
Even though attackers were careful enough to wipe their traces, at least one server they breached for another campaign contained a serious mistake with an important artefact being left behind. In preparation for operation, the server was configured as the command & control center for the malware. The first connections made on the day of configuration were coming from a few VPN/proxy servers indicating a testing period for the C&C server. However, there was one short connection on that day which was coming from a very rare IP address range in North Korea.
According to researchers, that could mean several things:
- The attackers connected from that IP address in North Korea
- It was someone else’s carefully planned false flag operation
- Someone in North Korea accidentally visited the command and control URL
The Lazarus group heavily invests in new variants of their malware. For months they were trying to create a malicious toolset which would be invisible to security solutions, but every time they did this, Kaspersky Lab’s specialists managed to identify unique features in how they create their code, allowing Kaspersky Lab to keep tracking the new samples. Now, the attackers have gone relatively quiet, which probably means that they have paused to rework their arsenal.
“We’re sure they’ll come back soon. In all, attacks like the ones conducted by Lazarus group show that a minor misconfiguration may result in a major security breach, which can potentially cost a targeted business hundreds of millions of dollars in loss. We hope that chief executives from banks, casinos and investment companies around the world will become wary of the name Lazarus,” said Vitaly Kamluk, Head of Global Research and Analysis Team APAC at Kaspersky Lab.
Kaspersky Lab products successfully detect and block the malware used by the Lazarus threat actor with the following specific detection names:
The company is also releasing crucial Indicators of Compromise (IOC) and other data to help organisations search for traces of these attack groups in their corporate networks. For more information go to Securelist.com
We urge all organisations to carefully scan their networks for the presence of Lazarus malware samples and, if detected, to disinfect their systems and report the intrusion to law enforcement and incident response teams.
Notre Dame, Scoop Makhathini, GoT, top week in search
From fire disaster to social media disaster, the top Google searches this week covered a wide gamut of themes.
Paris and the whole world looked on in shock as the 856-year-old medieval Catholic cathedral crumbled into ash. The tragic infernal destruction of this tourist attraction of historical and religious significance led South Africans to generate more than 200 000 search queries for “Notre Dame Cathedral” on Monday. Authorities are investigating the cause of the fire that razed the architectural icon.
In other top trending searches on Google this week, radio presenter Siyabonga Ngwekazi, AKA Scoop Makhathini, went viral when it appeared he had taken to Twitter to expose his girlfriend, Akhona Carpede, for cheating on him. Scoop has since come out to say that he was not responsible for the bitter rant and that his account was hacked. “Scoop Makhathini” generated more than 20 000 search queries on Wednesday.
Fans generated more than 20 000 search queries for “Sam Smith” on Tuesday ahead of the the British superstar’s Cape Town performance at the Grand West Casino. Smith ended up cutting his performance short that night due to vocal strain.
Local Game of Thrones superfans were beside themselves on Sunday, searching the internet high and low for the first episode of the American fantasy drama’s eighth season. “Game of Thrones, season 8, episode 1” generated more than 100 000 queries on Google Search on the weekend.
As the festivities kicked off in California with headliners such as Childish Gambino and Ariana Grande, South Africans generated more than 2 000 search queries for “Coachella” on Saturday.
South Africans generated more than 5 000 search queries for “Wendy Williams” on Friday as it emerged that the American talk show host had filed for divorce from her husband Kevin Hunter after 21 years of marriage. Hunter has long been rumored to have been cheating on Williams, which reportedly finally led to the divorce.
Search trends information is gleaned from data collated by Google based on what South Africans have been searching for and asking Google. Google processes more than 40 000 search queries every second. This translates to more than a billion searches per day and 1.2 trillion searches per year worldwide. Live Google search trends data is available at https://www.google.co.za/trends/hottrends#pn=p40
5G smartphones to hit 5M sales in 2019
According to the latest research from Strategy Analytics, global smartphone shipments will reach a modest 5 million units in 2019. Early 5G smartphone models will be expensive and available in limited volumes. Samsung, LG and Huawei will be the early 5G smartphone leaders this year, followed by Apple next year.
Ken Hyers, Director at Strategy Analytics, said, “We forecast global 5G smartphone shipments will reach a modest 5 million units in 2019. Less than 1 percent of all smartphones shipped worldwide will be 5G-enabled this year. Global 5G smartphone shipments are tiny for now, due to expensive device pricing, component bottlenecks, and restricted availability of active 5G networks.”
Ville Petteri-Ukonaho, senior analyst at Strategy Analytics, added, “Samsung will be the early 5G smartphone leader in the first half of 2019, due to initial launches across South Korea and the United States. We predict LG, Huawei, Xiaomi, Motorola and others will follow later in the year, followed by Apple iPhone with its first 5G model during the second half of 2020. The iPhone looks set to be at least a year behind Samsung in the 5G smartphone race and Apple must be careful not to fall too far behind.”
Neil Mawston, executive director at Strategy Analytics, added, “The short-term outlook for 5G smartphones is weak, but the long-term opportunity remains huge. We forecast 1 billion 5G smartphones to ship worldwide per year by 2025. The introduction of 5G networks, by carriers like Verizon or China Mobile, opens up high-speed, ultra-low-latency services such as 8K video, streaming games, and augmented reality for business. The next big question for the mobile industry is how much extra consumers are really willing to pay, if anything, for those emerging 5G smartphones and services.”
Strategy Analytics provides a snapshot analyses for the outlook for 5G smartphone market in this Insight report: 5G Smartphones : From Zero to a Billion
Strategy Analytics provides a deep-dive into the air-interface technologies that will power phones through 2024 across 88 countries here: Global Handset Sales Forecast by 88 Countries and 19 Technologies : 2003 to 2024