North Korea Accused of Hacking Russian Targets Amid Ukraine War

North Korean hackers targeted Russian diplomats and breached a Russian aerospace research institute in March, according to Microsoft.
Microsoft believes North Korea may be spying on Russia while it is focused on the war in Ukraine.
North Korea has been accused before of hacking targets in South Korea, the U.S., and elsewhere.
Last month, North Korean hackers were revealed to have breached a major Russian missile developer.
The hacking allegations were made in a Microsoft report that also covered Chinese hacking of U.S. critical infrastructure and China's use of AI for propaganda.

reuters.com

Relevant topic timeline:

8/3/2023

Russia-backed hackers used Microsoft Teams to breach government agencies

Main topic: Russian state-sponsored hackers posing as technical support staff on Microsoft Teams to compromise global organizations, including government agencies. Key points: 1. The hacking campaign was carried out by a Russian state-sponsored group known as APT29 or Cozy Bear. 2. The group is linked to the SolarWinds attack in 2020 and is part of Russia's Foreign Intelligence Service. 3. The hackers used previously compromised Microsoft 365 accounts to create new technical support-themed domains. 4. They sent Microsoft Teams messages to manipulate users into granting approval for multi-factor authentication prompts. 5. By gaining access to user accounts, the hackers aimed to exfiltrate sensitive information. 6. Less than 40 unique global organizations were targeted or breached, including government agencies, non-government organizations, and various sectors. 7. Microsoft has mitigated the use of the domains and continues to investigate the activity. 8. The campaign follows a recent incident where Chinese hackers exploited a flaw in Microsoft's cloud email service.

9/7/2023

Iranian hackers breach US aviation org via Zoho, Fortinet bugs

State-backed hacking groups have breached a U.S. aeronautical organization by exploiting critical vulnerabilities in Zoho and Fortinet software, according to a joint advisory by CISA, the FBI, and USCYBERCOM, with the attackers suspected to be linked to Iranian exploitation efforts.

9/16/2023

North Korea Using Russian Crypto Exchanges to Launder Billions in Stolen Crypto Funds: Report

Hackers from North Korea are using Russian crypto exchanges known for money laundering to transfer stolen digital assets, according to market intelligence firm Chainalysis. The firm's on-chain data reveals that hacking groups linked to North Korea are increasingly using Russian exchanges to launder funds stolen from decentralized app project Harmony (ONE), with evidence showing that DPRK entities have been using Russian services for money laundering since 2021.

Topics

Posted 9/7/2023, 1:12:00 PM