For example, Mandiant has described activity known as CryptoCore and Dangerous Password as a \u201clikely subgroup of APT38\u201d. Proofpoint adds SnatchCrypto<\/a>, and defines all three as campaigns operated by TA444. If both sets of researchers are correct, it may be that TA444 is a subgroup of APT38. Nevertheless, the overlapping nature of differently named DPRK groups makes it difficult to delineate them clearly, and many people still refer to the umbrella name of Lazarus.<\/p>\n In its first publicly available report<\/a> on the TA444 group, Proofpoint notes that like other DPRK groups, it is likely tasked with stealing currency to offset sanctions against the state. Around 2017 it began to focus on stealing cryptocurrency. \u201cTA444 had two main avenues of initial access,\u201d notes the report: \u201can LNK-oriented delivery chain and a chain beginning with documents using remote templates.\u201d<\/p>\n In 2022, however, while continuing to use these methods, it increased its usage of macros for malware delivery. Usually, when threat actors experiment with new delivery mechanisms, they continue to use their existing payloads. Not so with TA444 in 2022. \u201cThis suggests,\u201d say the researchers, \u201cthat there is an embedded, or at least a devoted, malware development element alongside TA444 operators.\u201d<\/p>\n In early December 2022, the researchers observed a new approach from TA444 \u2013 a relatively basic credential harvesting phishing campaign. A TA444 C2 domain began distributing OneDrive phishing emails \u201crife with typos\u201d to targets in the US and Canada. The infrastructure used suggests it was TA444; the campaign suggests otherwise.<\/p>\n The researchers offer three possibilities: it could be TA444 simply expanding its repertoire; the group could be moonlighting from its primary purpose of sidestepping North Korea\u2019s sanctions; or a different threat actor could have hijacked TA444\u2019s infrastructure.<\/p>\n Whatever the reason, the phishing campaign in December nearly doubled the total volume of TA444 emails observed by Proofpoint for the whole of 2022. Emails were sent to Admin at the target domain. The From entry was \u201cadmin[@]sharedrive[.]ink \u2013 and the subject was \u2018linvoice\u2019 (that is, Invoice starting with a lowercase L rather than uppercase I).<\/p>\n The lure entices the target to click on a SendGrid URL, which redirects to the attackers\u2019 credential harvesting page, which in turn uses common phishing tactics such as loading the victim\u2019s iconography via the logo-rendering service ClearBit.<\/p>\n Proofpoint has \u2018moderate to moderately high\u2019 confidence that the campaign is operated by TA444, based on the exclusivity of TA444\u2019s infrastructure. \u201cThe emails also had valid DMARC and SPF records, indicating that the sender has control of that domain,\u201d add the researchers.<\/p>\n Related<\/strong>: FBI Confirms North Korean Hackers Behind $100M Horizon Bridge Heist<\/a><\/p>\n Related<\/strong>: Lazarus Group Targets South Korea via Supply Chain Attack<\/a><\/p>\n Related<\/strong>: North Korea APT Lazarus Targeting Chemical Sector<\/a><\/p>\n Related<\/strong>: North Korea\u2019s Lazarus Targets Energy Firms With Three RATs<\/a><\/p>\n The post North Korean APT Expands Its Attack Repertoire<\/a> appeared first on SecurityWeek<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" The advanced persistent threat (APT) tracked as TA444 is either moonlighting from its previous primary purpose, expanding its attack repertoire, or is being impersonated (that is, has had its infrastructure abused by other hackers).\u00a0 TA444 is a North Korean state-sponsored threat group tracked by Proofpoint as actively targeting cryptocurrencies since at least 2017. It has […]<\/p>\n","protected":false},"author":2,"featured_media":16682,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[100,101,69,77,102,17,103],"tags":[],"class_list":["post-16681","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apt38","category-cryptocurrency","category-featured","category-nation-state","category-north-korea","category-phishing","category-ta444"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts\/16681","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/comments?post=16681"}],"version-history":[{"count":0,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts\/16681\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/media\/16682"}],"wp:attachment":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/media?parent=16681"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/categories?post=16681"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/tags?post=16681"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/figcaption><\/figure>\n
![\"Graphical](\"https:\/\/lh5.googleusercontent.com\/Ox3ov3uGKjIW7wHho5QNNqLIsw55POG8vXMW260vz8Cs5nXITyTTe1PEbLDe4f2wAuGDrIXY7nMP9Fx-dMRekKBRujPFKaHk4uwU7R20aDnl3qRtgUGs2D6e-dPoAAZw2V_t808slKJtwmRklYxf3cjZflKm9jRJ2CD6sIKtkCcXoW9A1uC94peQN4fdPxahcxOBg3ZuSA\")