Pierluigi Paganini August 29, 2020

North Korea-linked APT group BeagleBoyz intensified its operations since February, US CISA, Department of the Treasury, FBI, and USCYBERCOM warn.

According to a joint advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, the Federal Bureau of Investigation (FBI), and U.S. Cyber Command (USCYBERCOM) North Korea-linked APT group BeagleBoyz was very active since February 2020 targeting banks across the world.

BeagleBoyz (aka Lazarus, APT38, Bluenoroff, and Stardust Chollima) represents a subset of the HIDDEN COBRA threat actors.

The BeagleBoyz APT group surged in 2014 and 2015, its members used mostly custom-tailored malware in their attacks. This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems.

The group is considered responsible for the massive WannaCry ransomware attack, a string of SWIFT attacks in 2016, the Sony Pictures hack, the FASTCash ATM attacks against banks, and attacks on multiple cryptocurrency exchanges.

“North Korea’s intelligence apparatus controls a hacking team dedicated to robbing banks through remote internet access. To differentiate methods from other North Korean malicious cyber activity, the U.S. Government refers to this team as BeagleBoyz, who represent a subset of HIDDEN COBRA activity.” reads the alert. “The BeagleBoyz’s bank robberies pose severe operational risk for individual firms beyond reputational harm and financial loss from theft and recovery costs. The BeagleBoyz have attempted to steal nearly $2 billion since at least 2015, according to public estimates. Equally concerning, these malicious actors have manipulated and, at times, rendered inoperable, critical computer systems at banks and other financial institutions.”

Government experts reported that the BeagleBoyz often leave destructive anti-forensic tools onto computer networks of victim institutions. In 2018, the group employed a wiper in the attack against the Banco de Chile bank in Chile in 2018.

According to the joint alert, BeagleBoyz performed fraudulent ATM cash outs from banks of 30 countries in a single incident. The conspirators have withdrawn cash from ATM machines operated by various unwitting banks in multiple countries worldwide, including in the United States.

In the arsenal of the group, there is custom malware specifically developed the targeting of switch applications on Windows servers, they also developed malware to target interbank payment processors.

Once compromised a target network, the threat actors selectively exploit systems within the environment and leverage multiple techniques to elevate privileges, execute malicious code, achieve persistence, and evade detection.

“Once inside a financial institution’s network, the BeagleBoyz appear to seek two specific systems—the SWIFT terminal and the server hosting the institution’s payment switch application. As they progress through a network, they learn about the systems they have accessed in order to map the network and gain access to the two goal systems.” continues the alert.

The BeagleBoyz employed multiple malware in their operations, including the CROWDEDFLOUNDER,  HOPLIGHT, and COPPERHEDGE RATs, the ECCENTRICBANDWAGON keylogger, the VIVACIOUSGIFT and ELECTRICFISH proxy tunneling tools.

The alert includes technical details on the threats and recommendations to prevent BeagleBoyz attacks.

Pierluigi Paganini

(SecurityAffairs – hacking, BeagleBoyz)

[adrotate banner=”5″]

[adrotate banner=”13″]