The APT exploited the Log4Shell vulnerability, installed XMRig, moved laterally to the domain controller (DC), compromised credentials, and implanted Ngrok reverse proxies.
Kaspersky cybersecurity experts: North Korea-linked malware hides itself inside an executable that looks like a legitimate program and has several stages of decryption before starting.
Kaspersky cybersecurity experts: The victims are lured to download the malware with Facebook and Instagram accounts, that point to a Telegram channel, that distributes a malicious VPN.
ESET cybersecurity experts: It’s a new version of the Android malware, and it has been used maybe as a prelude of a spear phishing attack via text messages.
The data breach could create huge problems to Moscow. Both on the propaganda on Ukraine and the internal security level. Data could boost cyber warfare/espionage.
Sentinel Labs cybersecurity experts: The the pro-China APT seeks initial access via document lures with porn themes and makes heavy use of USB shortcut techniques to spread malware.
Sekoia cybersecurity experts: The pro-Russia APT simulates the Baltic Defense College, the Austrian Economic Chamber and NATO’s JDAL platform for reconnaissance purpose.