North Korean hackers successfully create new macOS malware

North Korean hackers successfully created a new macOS malware, but the group's Telegram channel has been hacked.

What is known for North Korea, besides being the ultimate hairstyle of the Supreme Leader, is a culture that is hard to understand. Indispensable is the world's leading group of hackers who can hack government systems and leading organizations, and develop a variety of malware, even though the country has almost no Internet access. This time, it's another news that can make readers nervous and funny at the same time.

According to a report by the website Cyber News, a research team from Birmingham Cyber Arms, a cybermonitoring specialist company, has detected the activity of a group of prominent hackers from North Korea. Lazarus has developed a new malware focused on attacking macOS users, targeting software developers, corporate executives, and financial technology companies, or Fintech. In that attack, hackers will use the classic method of deceiving victims through social engineering, or social engineering. Hackers will find victims through the famous chat service Telegram. And invite you to talk about business negotiations and trick you into downloading fake Zoom, Microsoft Teams, and Google Meet applications, claiming they are necessary for consultation appointments.

After the victim installs the fake application to the machine and starts calling, there is an Error screen and requests that the victim perform a trial, paste, and run script that appears on the screen. If the victim believes, it will ultimately lead to malware installation. This method can be called a ClickFix technique. The malware has the ability to steal sensitive information on the victim's machine, such as passwords, codes saved on the Keychain, and Session information on the web browser, etc. These data are sent back to a control server (C2 or Command and Control) located on the hacker's channel (Channel) on Telegram.

A research team from Any.Run, a company that develops cyber tools, determined that the analysis of the code showed that malware was so bad that malware could easily be identified by excessive use of local resources, and that it still had a good ability to steal data, and with this abundance of vulnerabilities, a group of researchers from cybersecurity companies could penetrate the infrastructure located on Telegram. There are two vulnerabilities that are detected:

The first vulnerability was a folder used to support stolen files and data. The research team found that a folder located on this server could upload files without authentication, allowing the research team to flood junk files with just a few lines of script, causing hacker servers to freeze and Telegram accounts to be suspended.

The second vulnerability came from the malware code being so badly written that the API Token used to connect malware to the Bot on Telegram was revealed, which led to the eventual exposure of the account holder behind it as a group of hackers from North Korea, as well as the ability to use this vulnerability to flood the bot.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # hackers