Targeted ransomware attacks are on the rise. If Lazarus is confirmed as the Horizon Bridge hacker, Chainalysis said the attack will be the group’s eighth this year - totalling $1 billion in stolen funds. J5:20 pm 4 minute read A new ransomware, VHD, was seen being delivered by the nation-state group’s multiplatform malware platform, MATA. The FBI identified two groups behind the heist, including the Lazarus Group. In late March, around $620 million in Ethereum was stolen. The style of attack and the use of a “mixer” - used to obscure the origin of funds - is similar to previous hacks attributed to Lazarus, Chainalysis, a blockchain firm investigating the attack, said on Twitter. According to Kaspersky, the APT compromised multiple servers and uploaded several malicious scripts in the process. The hacking group had stolen the digital certificate from a US-based South Korean security company. The latest heist in decentralized finance (DeFi) occurred on June 23. During the attack, the North Korean APT deployed a compromised downloader Racket signed with a stolen digital certificate.

Horizon Bridge is a service operated by the Harmony blockchain that allows assets to be transferred to other blockchains. The attacks involved modifications of the well-known malware, DTrack, as well as the use of the brand-new Maui ransomware. Internal emails were also leaked after the studio released “The Interview,” a comedy that ridiculed North Korea’s leader Kim Jong-un. Woburn, MA Aug Kaspersky experts have uncovered new attacks by Andariel, an advanced persistent threat (APT) subgroup of Lazarus, known for its campaigns in South Korea. In 2014, Lazarus Group caused mayhem in Hollywood and Sony Pictures Entertainment when hundreds of hard drives were wiped.

This was a cyber-espionage campaign that used distributed denial-of-service attack (DDoS) techniques to target the South Korean government in Seoul. The hacking group’s earliest known attack is “Operation Troy,” which occurred from 2009 to 2012. Back in 2016, the APT group carried out a cyber-attack against the Central Bank of Bangladesh followed by a successful hack into SWIFT, the main platform for worldwide interbank financial telecommunication and funds that transfers between banks around the world that processes around 25 million communications (mostly money transfer transactions).

Stolen funds are used to support North Korea’s weapons of mass destruction and its ballistic missile programmes. Lazarus Group, also known as APT 38 (advanced persistent threat), is led by North Korea’s Reconnaissance General Bureau - Pyongyang’s intelligence agency.

Lazarus group apt