Lazarus hackers: Uncovered evidence suggests that the hackers blamed for the attacks that led to the Sony Pictures hack and the Bangladesh Central Bank robbery have launched a new wave of attacks.
The so-called Lazarus hackers are reportedly targeting banks and other organizations in 31 countries today, according to a warning from Symantec.
The new attacks appear to have been discovered after a hacking attempt on Polish banks resulted in them being loaded with malware. The malware was sent via the hacked Polish financial regulator as a warning document of these attacks: “shared indicators of compromise (IOCs)”
The attackers appear to be using hacked websites to redirect visitors to custom exploit kits, which are pre-configured to only infect visitors from around 150 different IP addresses. These IP addresses belong to 104 different organizations located in 31 different countries. The vast majority of these organizations are banks, with a small number of telecommunications companies and other online businesses.
The Lazarus Hackers have been linked to a series of attacks in 2009 targeting businesses in the US and South Korea. Some of the tools used in the Bangladesh Central Bank hack share many similarities in code with malware used in other attacks. One of these was the Sony Pictures hack that resulted in the company's films being leaked online before their official release.
The latest malware used in the attacks on Polish banks had similar code to the malware used by the Lazarus hackers in the attacks on Sony, according to Symantec.
More details about the attacks on Symantec's blog:
https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware-0
