For the first time a state-sponsored hacking outfit has adopted the EtherHiding methodology, a threat actor associated with the Democratic People’s Republic of Korea (often known as North Korea) has been seen using it to spread malware and facilitate cryptocurrency theft.
Google Threat Intelligence Group (GTIG) has linked the activity to a threat cluster it monitors as UNC5342, also known as CL-STA-0240 (Palo Alto Networks Unit 42), DeceptiveDevelopment (ESET), DEV#POPPER (Securonix), Famous Chollima (CrowdStrike), Gwisin Gang (DTEX), Tenacious Pungsan (Datadog), and Void Dokkaebi (Trend Micro).
The attack wave is a part of a long-running campaign called Contagious Interview, in which the attackers approach potential targets on LinkedIn by pretending to be hiring managers or recruiters. After moving the conversation to Telegram or Discord, they trick the target into running malicious code read more about North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.