In a concerning event, North Korean state-sponsored have again displayed their advanced cyber capabilities by abusing flaws in VPN software updates to plant malware. The incident highlights the rising threats from state-sponsored actors in the cybersecurity sector. “The Information Community attributes these hacking activities to the Kimsuky and Andariel hacking organizations under the North Korean Reconnaissance General Bureau, noting the unprecedented nature of both organizations targeting the same sector simultaneously for specific policy objectives,” NCSC said.
Attack Vector Details
The NCSC (National Cyber Security Center) recently detected two infamous North Korean hacking groups named Kimsuky (APT43) and Andariel (APT45) as the masterminds of these attacks. The groups have a past of attacking South Korean companies and have set their eyes on exploiting bugs in VPN software updates. Threat actors leveraged these flaws, gained access to networks, deployed malware, and stole sensitive data, including trade secrets.
How the attack works
The actors used a multi-dimensional approach to attack their targets. First, they identified and compromised vulnerabilities in the VPN softwar
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.