{"id":60357,"date":"2018-03-09T04:58:05","date_gmt":"2018-03-09T04:58:05","guid":{"rendered":"https:\/\/www.biphoo.com\/bipnews\/?p=60357"},"modified":"2018-03-09T04:58:05","modified_gmt":"2018-03-09T04:58:05","slug":"north-korea-suspected-cyberattack-turkey","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/world-news\/north-korea-suspected-cyberattack-turkey.html","title":{"rendered":"North Korea Suspected in Cyberattack on Turkey"},"content":{"rendered":"

North Korea Suspected in Cyberattack on Turkey<\/span><\/strong><\/span><\/h2>\n

Suspected North Korean hackers blitzed Turkish financial institutions and a government organization last week, seeking intelligence for a future heist, a new report says.<\/span><\/p>\n

The attacks on March 2 and 3, identified by cyber researcher McAfee LLC in a Thursday report, attempted to lure targets with faux links to a popular cryptocurrency platform, allowing hackers to plunder sensitive information about the breached computer networks. The report doesn\u2019t identify the entities struck. No money was taken.<\/span><\/p>\n

\u201cWhat you see here is the kind of precursor towards financial theft,\u201d said Raj Samani, McAfee\u2019s chief scientist, who described the hack as \u201ccasing the joint.\u201d<\/span><\/p>\n

As economic sanctions against North Korea have tightened over the past year, more of its cyberattacks have pursued financial gains, according to cybersecurity experts. North Korea has been suspected in digital raids of South Korean cryptocurrency exchanges last year. And recent targets have ranged from global banks to ATMs.<\/span><\/p>\n

What makes the Turkish attacks unusual is how quickly hackers created software to exploit a recently revealed weakness in Adobe Flash, using the program to implant malware onto victim\u2019s computers. Also unusual: how swiftly McAfee researchers unearthed the effort.<\/span><\/p>\n

McAfee policy is to not officially identify nation-state cyber units as culprits. But its Thursday report said the malware code closely resembles code used in attacks by a North Korea-linked hacking operative\u2014called Lazarus by many cyber researchers\u2014that was blamed for last year\u2019s WannaCry ransomware attack and the 2014 Sony Pictures hack.<\/span><\/p>\n

Last week\u2019s attacks, which McAfee calls the \u201cBankshot\u201d implant\u2014the malware is implanted in a file that infects computers\u2014compromised a number of computers in Turkey, McAfee said, and some early indications also suggest more financial organizations across Europe were infected.<\/span><\/p>\n

The Turkish campaign relies on malware that first appeared last year but was modified in recent weeks. The malicious files are distributed by spearphishing emails that contain Microsoft Word documents masquerading as an agreement template for bitcoin distribution, McAfee said.<\/span><\/p>\n

To trick the Turkish targets into opening the attachment, the hackers sent the emails from an account with the domain name falcancoin.io\u2014a name similar to that of a leading cryptocurrency lending platform, Falcon Coin.<\/span><\/p>\n

Viewing the file downloads the malware onto the recipient\u2019s computer, giving hackers remote access they can use to upload or download files or manipulate internal systems that could enable financial theft.<\/span><\/p>\n

The Microsoft Word document had an embedded Adobe Flash file that exploited a problem for which a software patch had been distributed just weeks before. The attackers were betting users had not downloaded that update.<\/span><\/p>\n

The attack shows the \u201cweaponization\u201d of such software holes, McAfee\u2019s Mr. Samani said.<\/span><\/p>\n

Once they have access, hackers can also pilfer internal organizational information for use in masking subsequent attacks. Even something as benign-seeming as printer names could be exploited: Recipients might be more apt to trust email attachments containing their office\u2019s printer name, said Christiaan Beek, McAfee\u2019s senior principal engineer.<\/span><\/p>\n

Source:-\u00a0https:\/\/www.wsj.com\/articles\/north-korea-suspected-in-cyberattack-on-turkey-1520517723<\/span><\/p>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t