Video | Agriculture | Confidence | Economy | Energy | Employment | Finance | Media | Property | RBNZ | Science | SOEs | Tax | Technology | Telecoms | Tourism | Transport | Search

 

Ransomware attacks show strong links to Lazarus group

WannaCry: Ransomware attacks show strong links to Lazarus group


Similarities in code and infrastructure indicate close connection to group that was linked to Sony Pictures and Bangladesh Bank attacks

Tools and infrastructure used in the WannaCry ransomware attacks have strong links to Lazarus, the group that was responsible for the destructive attacks on Sony Pictures and the theft of US$81 million from the Bangladesh Central Bank.

Prior to the global outbreak on May 12, an earlier version of WannaCry (Ransom.Wannacry) was used in a small number of targeted attacks in February, March, and April. This earlier version was almost identical to the version used in May 2017, with the only difference the method of propagation. Analysis of these early WannaCry attacks by Symantec’s Security Response team revealed substantial commonalities in the tools, techniques, and infrastructure used by the attackers and those seen in previous Lazarus attacks, making it highly likely that Lazarus was behind the spread of WannaCry. Despite the links to Lazarus, the WannaCry attacks do not bear the hallmarks of a nation-state campaign but are more typical of a cybercrime campaign. These earlier versions of WannaCry used stolen credentials to spread across infected networks, rather than leveraging the leaked Eternal Blue exploit that caused WannaCry to spread quickly across the globe starting on May 12.

Summary of links
· Following the first WannaCry attack in February, three pieces of malware linked to Lazarus were discovered on the victim’s network: Trojan.Volgmer and two variants of Backdoor.Destover, the disk wiping tool used in the Sony Pictures attacks.



· Trojan.Alphanc, which was used to spread WannaCry in the March and April attacks is a modified version of Backdoor.Duuzer, which has previously been linked to Lazarus.

· Trojan.Bravonc used the same IP addresses for command and control as Backdoor.Duuzer and Backdoor.Destover, both of which have been linked to Lazarus.

· Backdoor.Bravonc has similar code obfuscation as WannaCry and Infostealer.Fakepude (which has been linked to Lazarus).

· There is shared code between WannaCry and Backdoor.Contopee, which has previously been linked to Lazarus.

ends

© Scoop Media

 
 
 
Business Headlines | Sci-Tech Headlines

 

Provincial Growth Fund: Backing Growth In Gore

“Today’s announcements are a $1.6 million investment towards the Maruawai precinct project, which involves the redevelopment of the Hokonui Moonshine Museum and creation of the Maruawai Heritage Centre...” More>>

ALSO:

Inflation: Cigarette Price Rise Offsets Cheaper Petrol

The consumers price index (CPI) rose 0.1 percent in the March 2019 quarter, due to higher prices for cigarettes, Stats NZ said today... In the year to March 2019, the inflation rate was 1.5 percent, down from 1.9 percent in the December 2018 year. More>>

ALSO:

Government Suppliers: MBIE Reinstates Fuji Xerox As A

The government has reinstated Fuji Xerox as a supplier despite an ongoing Serious Fraud Office investigation into accounting irregularities that led to losses of more than $300 million. More>>

ALSO:

PSI: Service Sector Growth At Lowest Level Since 2012

April 15 (BusinessDesk) - New Zealand’s services sector activity grew at its slowest pace in more than six years in March, potentially signalling a slowdown in the domestic economy. More>>

ALSO: