North Korea pulled in $400m in cryptocurrency heists last year – report
(2022/01/16)
- Reference: 1642330873
- News link: https://www.theregister.co.uk/2022/01/16/in_brief_security/
- Source link:
In brief Thieves operating for the North Korean government made off with almost $400m in digicash last year in a concerted attack to steal and launder as much currency as they could.
A [1]report from blockchain biz Chainalysis found that attackers were going after investment houses and currency exchanges in a bid to purloin funds and send them back to the Glorious Leader's coffers. They then use mixing software to make masses of micropayments to new wallets, before consolidating them all again into a new account and moving the funds.
Bitcoin used to be a top target but Ether is now the most stolen currency, say the researchers, accounting for 58 per cent of the funds filched. Bitcoin accounted for just 20 per cent, a fall of more than 50 per cent since 2019 - although part of the reason might be that they are now so valuable people are taking more care with them.
[2]
"These behaviors paint a portrait of a nation that supports cryptocurrency-enabled crime on a massive scale," the report finds. "Systematic and sophisticated, North Korea’s government — be it through the Lazarus Group or its other criminal syndicates — has cemented itself as an advanced persistent threat to the cryptocurrency industry in 2021."
Football fans furious after FIFA 22 after top players' accounts taken over
Electronic Arts (EA) has confirmed that some of the top players of the FIFA 22 football (soccer in Freedom Language) game have had their accounts taken over after it dropped the ball.
"Through our initial investigation we can confirm that a number of accounts have been compromised via phishing techniques," EA said in a [3]statement .
[4]
[5]
"Utilizing threats and other 'social engineering' methods, individuals acting maliciously were able to exploit human error within our customer experience team and bypass two-factor authentication to gain access to player accounts."
In response EA says that it has strengthened its account verification process and is training up staff to be on the lookout for behavior that indicates someone is playing foul. It says this will take time and may lead to support delays, but asks fans not to show it the red card.
US government warns of Russia and Iranian online intrusion, makes tools public
It has been a busy week for those monitoring government hacking threats, beginning with a warning from the FBI, NSA and CISA about Russian state online spies are breaking into US systems, followed by a report from US Cyber Command on Iranian online foes.
The Russians are targeting US government, energy and infrastructure companies, the first [6]advisory warns , and are using advanced tactics to do so. The key protection is frequent logging and examination of network activity, but also watch for unexpected equipment activity like unplanned reboots, and multiple failed login attempts on accounts, they advise.
[7]
Not to be outdone, US Cyber Command released a report into an online gang called MuddyWater, which the agency says operates under the auspices of the Iranian Ministry of Intelligence and Security. It's primarily an intelligence collection group and had been targeting other Middle Eastern states, but is now expanding operations in the US and Western Europe.
MuddyWater specialize in using open-source tools and side-loading DLLs, and they also are adept at using tunneling to shield their activities. VirusTotal have been informed and you can get the [8]full details here.
Texans hit by QR code phishing campaign
Residents of the Lone Star state have been under [9]sustained attack from a QR code phishing scam using traffic meters that is designed to harvest credit card information.
Police in Austin, Houston and San Antonio have warned that persons unknown are attaching fake QR codes to parking meters that redirect users to a carefully crafted phishing site. When the meter user tries to pay for their parking that are simply handing over their card information to the criminals.
What makes this form of attack particularly odd is that none of the cities targeted actually use QR codes on their meters. "We've talked to industry professionals who have warned us about using QR codes, and that's why we do not utilize QR codes on our infrastructure at all," Austin Parking Enterprise Manager Jason Redfern [10]told Fox 7 .
Still using WordPress? Plugin vulns rose 142 per cent last year
WordPress is a very popular platform but security isn't one of its strengths, as a review of its progress in 2021 has shown.
[11]Research by Risk Based Security found that last year the number of vulnerabilities found in WordPress plugins shot up 142 per cent, 77 per cent of them contained known public exploits and 73 per cent were remotely exploitable. While the average rating for flaws using the Common Vulnerability Scoring System was 5.5 there are still some very nasty issues out there that need to be addressed.
[12]
"There are over 58,000 free plugins for download, with tens of thousands more available for purchase," the report warns. "Unfortunately, few of them are designed with security in mind, so one vulnerability could potentially affect millions of users."
Get our [13]Tech Resources
[1] https://blog.chainalysis.com/reports/north-korean-hackers-have-prolific-year-as-their-total-unlaundered-cryptocurrency-holdings-reach-all-time-high/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.ea.com/en-gb/games/fifa/fifa-22/news/pitch-notes-fifa-22-account-takeover-update
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.cisa.gov/uscert/ncas/alerts/aa22-011a
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/
[9] https://www.gcn.com/cybersecurity/2022/01/cities-texas-hit-qr-code-phishing-scam/360554/
[10] https://www.fox7austin.com/news/fraudulent-qr-code-stickers-found-on-29-austin-public-parking-meters
[11] https://www.riskbasedsecurity.com/2022/1/11/wordpress-vulnerabilities-more-than-doubled-in-2021/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
A [1]report from blockchain biz Chainalysis found that attackers were going after investment houses and currency exchanges in a bid to purloin funds and send them back to the Glorious Leader's coffers. They then use mixing software to make masses of micropayments to new wallets, before consolidating them all again into a new account and moving the funds.
Bitcoin used to be a top target but Ether is now the most stolen currency, say the researchers, accounting for 58 per cent of the funds filched. Bitcoin accounted for just 20 per cent, a fall of more than 50 per cent since 2019 - although part of the reason might be that they are now so valuable people are taking more care with them.
[2]
"These behaviors paint a portrait of a nation that supports cryptocurrency-enabled crime on a massive scale," the report finds. "Systematic and sophisticated, North Korea’s government — be it through the Lazarus Group or its other criminal syndicates — has cemented itself as an advanced persistent threat to the cryptocurrency industry in 2021."
Football fans furious after FIFA 22 after top players' accounts taken over
Electronic Arts (EA) has confirmed that some of the top players of the FIFA 22 football (soccer in Freedom Language) game have had their accounts taken over after it dropped the ball.
"Through our initial investigation we can confirm that a number of accounts have been compromised via phishing techniques," EA said in a [3]statement .
[4]
[5]
"Utilizing threats and other 'social engineering' methods, individuals acting maliciously were able to exploit human error within our customer experience team and bypass two-factor authentication to gain access to player accounts."
In response EA says that it has strengthened its account verification process and is training up staff to be on the lookout for behavior that indicates someone is playing foul. It says this will take time and may lead to support delays, but asks fans not to show it the red card.
US government warns of Russia and Iranian online intrusion, makes tools public
It has been a busy week for those monitoring government hacking threats, beginning with a warning from the FBI, NSA and CISA about Russian state online spies are breaking into US systems, followed by a report from US Cyber Command on Iranian online foes.
The Russians are targeting US government, energy and infrastructure companies, the first [6]advisory warns , and are using advanced tactics to do so. The key protection is frequent logging and examination of network activity, but also watch for unexpected equipment activity like unplanned reboots, and multiple failed login attempts on accounts, they advise.
[7]
Not to be outdone, US Cyber Command released a report into an online gang called MuddyWater, which the agency says operates under the auspices of the Iranian Ministry of Intelligence and Security. It's primarily an intelligence collection group and had been targeting other Middle Eastern states, but is now expanding operations in the US and Western Europe.
MuddyWater specialize in using open-source tools and side-loading DLLs, and they also are adept at using tunneling to shield their activities. VirusTotal have been informed and you can get the [8]full details here.
Texans hit by QR code phishing campaign
Residents of the Lone Star state have been under [9]sustained attack from a QR code phishing scam using traffic meters that is designed to harvest credit card information.
Police in Austin, Houston and San Antonio have warned that persons unknown are attaching fake QR codes to parking meters that redirect users to a carefully crafted phishing site. When the meter user tries to pay for their parking that are simply handing over their card information to the criminals.
What makes this form of attack particularly odd is that none of the cities targeted actually use QR codes on their meters. "We've talked to industry professionals who have warned us about using QR codes, and that's why we do not utilize QR codes on our infrastructure at all," Austin Parking Enterprise Manager Jason Redfern [10]told Fox 7 .
Still using WordPress? Plugin vulns rose 142 per cent last year
WordPress is a very popular platform but security isn't one of its strengths, as a review of its progress in 2021 has shown.
[11]Research by Risk Based Security found that last year the number of vulnerabilities found in WordPress plugins shot up 142 per cent, 77 per cent of them contained known public exploits and 73 per cent were remotely exploitable. While the average rating for flaws using the Common Vulnerability Scoring System was 5.5 there are still some very nasty issues out there that need to be addressed.
[12]
"There are over 58,000 free plugins for download, with tens of thousands more available for purchase," the report warns. "Unfortunately, few of them are designed with security in mind, so one vulnerability could potentially affect millions of users."
Get our [13]Tech Resources
[1] https://blog.chainalysis.com/reports/north-korean-hackers-have-prolific-year-as-their-total-unlaundered-cryptocurrency-holdings-reach-all-time-high/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.ea.com/en-gb/games/fifa/fifa-22/news/pitch-notes-fifa-22-account-takeover-update
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.cisa.gov/uscert/ncas/alerts/aa22-011a
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/
[9] https://www.gcn.com/cybersecurity/2022/01/cities-texas-hit-qr-code-phishing-scam/360554/
[10] https://www.fox7austin.com/news/fraudulent-qr-code-stickers-found-on-29-austin-public-parking-meters
[11] https://www.riskbasedsecurity.com/2022/1/11/wordpress-vulnerabilities-more-than-doubled-in-2021/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeRPN8qvag7GE@sTAQGfaAAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: Further to the North Korea story:
Clausewitz 4.0
I must say NSA/FBI/CIA are a bit persistent.
One could think they use even mind-reading microchips to go after some folks.
20+ years programming, 9+ assassination attempts, patience is a virtue.
Unfair!
ThatOne
> The Russians are targeting US government, energy and infrastructure companies [...], and are using advanced tactics to do so
The rascals! Instead of using simplistic tactics so our under-trained and underpaid wage slaves can fend them off with a broom...
cryptocurrency
Snowy
Cryptocurrencies so untraceable and anonymous but Chainalysis are so good they can track and find out who did it and where the funds went. Even when they used a mixer not once but multiple times.
Re: cryptocurrency
Clausewitz 4.0
Wrong.
If properly done, it is untraceable.
Owning an exchange may help.
Re: cryptocurrency
RegGuy1
Yes indeed. And I thought the North Koreans were starving and so had other things on their minds. How do the find the time to train these people? Still better these foreigners doing it, coz if it was in the UK you just know it would be the remoaners' fault.
Further to the North Korea story:
$240m (IIRC) of that $400m is apparently still sitting parked, not yet monetised.
The theory is that they're waiting for law enforcement's alertness to drop, playing the long game to maximise the net amount brought home safely.