North Korea Threat Group Targeting Turkish Financial Orgs

[Faybert]

Hidden Cobra appears to be collecting information for a later strike, McAfee says.

Hidden Cobra, a threat group that the US government previously has linked to North Korea, appears to have turned its sights on financial institutions in Turkey.

Security vendor McAfee Thursday reported finding malware associated with the group surfacing on systems belonging to three large financial organizations and at least two major government-controlled entities involved in finance and trade in Turkey.

The malware, dubbed Bankshot, was last seen in 2017 and is designed to persist on compromised systems for further exploits. Its presence on the systems in Turkey suggests the Hidden Cobra operation is intended to gather specific information that can be used to launch more damaging attacks later, McAfee said.

"While we can't definitively establish motivations, it's likely these attacks are part of an ongoing effort on the part of the attackers to compromise major financial institutions," says Ryan Sherstobitoff, McAfee's senior analyst of major campaigns. The goal could be to "surveil their operations, establish functions of their processes, and ultimately compromise funds," he says.

Hidden Cobra, also referred to as the Lazarus Group and Guardians of Peace, is believed responsible for the attacks on the SWIFT financial network in 2016 that resulted in over $80 million being looted from the Bangladesh Bank. It has also been linked to numerous other attacks on media, aerospace, and critical infrastructure organizations in recent years.
....
....
....