Observes Targeted Attacks Amid FBI Warnings
Sept. 17, 2024, 2:59 p.m.
Tags
External References
Description
The report details targeted attacks observed by Jamf Threat Labs that align with FBI warnings about the Democratic People's Republic of Korea (DPRK) targeting individuals in the crypto industry through social engineering tactics for malware delivery. It outlines attack scenarios involving malicious coding challenges and techniques to install backdoor malware, steal credentials, and maintain persistence. Analysis of the malware's capabilities, updates, and command-and-control infrastructure is provided.
Date
Published: Sept. 17, 2024, 1:55 p.m.
Created: Sept. 17, 2024, 1:55 p.m.
Modified: Sept. 17, 2024, 2:59 p.m.
Indicators
185.234.216.180
139.59.182.234
62.204.41.73
https://taurihostmetrics.com/cloud/zsh_env
https://taurihostmetrics.com/cloud/VisualStudioHelper
wiresapplication.com
taurihostmetrics.com
juchesoviet48.com
Attack Patterns
Thiefbucket
Rustdoor
Democratic People's Republic of Korea (DPRK)
T1546.003
T1547.010
T1505.002
T1610
T1589.001
T1589
T1021.001
T1059.006
T1137
T1059.005
T1497.001
T1059.001
T1547.001
T1059.007
T1056.001
T1592
Additional Informations
Technology
Finance