North Korea targeted UN Security Council officials with spear-phishing campaign
August 5, 2020 Leave a comment
Computer hackers working for North Korea launched cyberattacks against carefully selected officials of national delegations belonging to the United Nations Security Council, according to a soon-to-be released report. The report is expected to be submitted early next month to the UN Security Council Sanctions Committee on North Korea.
Known previously as the UN Security Council Committee Established Pursuant to Resolution 1718, the committee was created in 2006 as part of the UN Security Council’s resolution 1718. The resolution was implemented in response to the first nuclear test conducted by North Korea on October 9 of that year, which confirmed beyond doubt the existence of Pyongyang’s nuclear weapons program. The committee’s mission is to gather information about North Korea’s nuclear activities, examine and evaluate the impact of international sanctions, and issue periodic recommendations to the UN National Security Council.
A draft version of the report was leaked to the media earlier this week. It states that a North Korean cyberattack targeted at least 11 officials belonging to six different national delegations that are members of the UN National Security Council. According to the draft report, the 11 officials were targeted earlier this year via a so-called “spear-phishing” campaign. The term refers to cyber-espionage operations in which hackers carefully select specific staff members of larger organizations for penetration. The targeted officials were reportedly approached using Gmail and WhatsApp, by a group of hackers who used fake identities.
The report also details efforts by the North Korean regime to acquire foreign hard currency through illicit hacking operations, as well as by illicitly acquiring virtual assets, such as cryptocurrencies. There is increasing speculation among North Korea observers about Pyongyang’s involvement in the cryptocurrency industry —though how exactly the government manages to cash out its alleged cryptocurrency assets remains a mystery.
► Author: Joseph Fitsanakis | Date: 05 August 2020 | Permalink
intelNews.org 
US government takes control of Internet domains used by SolarWinds hackers
June 3, 2021 by Joseph Fitsanakis Leave a comment
THE UNITED STATES GOVERNMENT has taken control of two Internet domains used last month in a large-scale phishing campaign by the same Russian-linked hacker group that was behind SolarWinds. The Department of Justice said on Tuesday it seized the two domains, theyardservice[.]com and worldhomeoutlet[.]com, on May 28, following a decision by a US court that authorized the action.
The large-scale attack was detected on May 25, and was delivered in over 3,000 emails sent from a compromised account belonging to the United States Agency for International Development (USAID). The compromised account was paired with the services of a legitimate email marketing company called Constant Contact. It was subsequently used to deliver phishing emails to the employees of over 150 organizations worldwide, most of them American.
The phishing emails featured an official USAID logo, beneath which was an embedded link to a purported “USAID Special Alert” titled “Donald Trump has published new documents on election fraud”. The link sent users to one of the two illicit subdomains, which infected victim machines with malware. The latter created a back door into infected computers, which allowed the hackers to maintain a constant presence in the compromised systems.
According to Microsoft Corporation, the hackers behind the phishing attack originated from the same group that orchestrated the infamous SolarWinds hack in 2020. The term refers to a large-scale breach of computer systems belonging to the United States federal government and to organizations such as the European Union and the North Atlantic Treaty Organization. The threat actor behind the attack is referred to by cybersecurity experts as APT29 or Nobelium, among other names.
Speaking on behalf of the US Department of Justice’s National Security Division, Assistant Attorney General John C. Demers said on Tuesday that the seizure of the two Internet domains demonstrated the Department’s “commitment to proactively disrupt hacking activity prior to the conclusion of a criminal investigation”.
► Author: Joseph Fitsanakis | Date: 03 June 2021 | Permalink
Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with APT29, computer hacking, cyber security, News, Nobelium, phishing, United States, US Department of Justice, US Department of Justice National Security Division, USAID