New ransomware strains linked to North Korean govt hackers

A number of ransomware strains have been connected to APT38, a North Korean-sponsored hacking group acknowledged for its focus on concentrating on and stealing cash from economical institutions around the globe.

They are also acknowledged for deploying harmful malware on their victims’ networks in the course of the final stage of their attacks, most likely to ruin any traces of their activity.

Christiaan Beek, a direct danger researcher at cybersecurity agency Trellix, claimed that the group’s operators (section of Device 180 of North Korea’s cyber-army Bureau 121) have also utilised the Beaf, PXJ, ZZZZ, and ChiChi ransomware family members to extort some of their victims.

The backlinks to APT38 have been found though analyzing code and artifact similarity with VHD ransomware which, just like TFlower ransomware, was linked to the North Korean Lazarus APT group.

Kaspersky and Sygnia researchers designed the link soon after viewing the two strains becoming deployed on victims’ networks through the cross-platform MATA malware framework, a malicious device solely employed by Lazarus operators, according to Kaspersky.

Beek discovered on Wednesday that — centered on visualizing the code employing Hilbert curve mapping — PXJ, Beaf, and ZZZZ share a notable amount of source code and features with VHD and TFlower ransomware, with Beaf and ZZZZ becoming virtually precise clones of each and every other.

“You you should not have to be a malware expert to straight away identify that the ZZZ and BEAF Ransomware pictures are just about equivalent,” the Trellix researcher claimed.

“It also turns into obvious that both Tflower and ChiChi are vastly diverse when compared to VHD.”

Though ChiChi’s codebase has small to no widespread factors, Beek was ready to find that the Semenov[.]akkim@protonmail[.]com e mail address was applied by the two ChiChi and ZZZZ in their ransom notes.

Attacks applying these ransomware households have only specific entities in the Asia-Pacific (APAC), making it more difficult to come across the victims’ identities considering that there were being no negotiation chats or leak web pages to look into.

Trellix also attempted to explore additional backlinks by examining the cryptocurrency transfers powering ransom payments but located no overlap in the crypto wallets utilised to accumulate ransoms.

Even so, they found out that the North Korean hackers have been only equipped to accumulate modest quantities of crypto belongings (for instance, a 2.2 BTC transfer in mid-2020, truly worth $20,000 at the time).

“We suspect the ransomware households [..] are portion of much more organized assaults,” Beek extra. 

“Centered on our study, merged intelligence, and observations of the lesser qualified ransomware assaults, Trellix characteristics them to DPRK affiliated hackers with superior self esteem.”