Google has identified a North Korean government hacking group that is targeting members of the cyber-security community engaging in vulnerability research.
The hacking group has used multiple platforms to communicate with potential targets, including Twitter, LinkedIn, Telegram, Discord, Keybase, and email.
In order to build credibility and connect with security researchers, the bad actors established a research blog and multiple Twitter profiles to interact with potential targets.
“They’ve used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits, and for amplifying and retweeting posts from other accounts that they control,” revealed the Google Threat Analysis Group team.
“The actors behind this campaign, which we attribute to a government-backed entity based in North Korea, have employed a number of means to target researchers”.
Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.
On January 14, the actors shared via Twitter a YouTube video they uploaded that proclaimed to exploit CVE-2021-1647, a recently patched Windows Defender vulnerability.
“Multiple comments on YouTube identified that the video was faked and that there was not a working exploit demonstrated,” Google said in a blog post on Monday.
After these comments were made, the actors used a second Twitter account (that they control) to retweet the original post and claim that it was “not a fake video.”
The actors have been observed targeting specific security researchers by a novel social engineering method.
After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with a “Visual Studio Project”.
“If you are concerned that you are being targeted, we recommend that you compartmentalize your research activities using separate physical or virtual machines for general web browsing, interacting with others in the research community, accepting files from third parties, and your own security research,” the Google team elaborated.
