APT43 Hackers Attacking Academic Institutions With Exposed Credentials

APT43, a notorious North Korean state-sponsored hacking group, has been actively targeting academic institutions worldwide, exploiting exposed credentials to gain unauthorized access.

Linked to the Reconnaissance General Bureau (RGB), APT43 is known for its strategic intelligence gathering and financially motivated activities.

APT43, also known by aliases such as Black Banshee, Emerald Sleet, Kimsuki, and Thallium, has been involved in espionage and financial cybercrime.

Their tactics include credential harvesting, exploiting vulnerabilities, and advanced social engineering techniques.

Cyfirma analysts detected that the group uses a variety of malware, including RftRAT, VENOMBITE, and DEEP#GOSU, to infiltrate systems.

Techniques Used

APT43 employs several MITRE ATT\&CK techniques to evade detection and achieve their objectives:

• Reconnaissance: Techniques like T1594 and T1593.001 are used for initial reconnaissance.
• Execution: T1053.005 and T1059.003 are utilized for executing malicious code.
• Defense Evasion: Techniques such as T1027 and T1562.001 help evade security measures.
• Lateral Movement: T1550.002 and T1021.001 facilitate movement within compromised networks.

Recently, APT43 has focused on targeting South Korean academic institutions, particularly those involved in political research related to North Korea.

They have evolved their tactics to include stealing and laundering cryptocurrency, supporting the North Korean government through these illicit activities.

APT43 continues to adapt its tactics, shifting its focus based on directives from the North Korean government.

Their targets include government agencies, diplomatic entities, and healthcare organizations. Leveraging advanced social engineering techniques, they craft highly convincing fake personas to establish trust before executing malware attacks.

Beyond espionage, the group has increasingly turned to financially motivated cybercrime, laundering stolen cryptocurrency through legitimate cloud-mining services.

The growing threat posed by APT43 shows the need for strong credential security and comprehensive cybersecurity strategies, particularly within academic institutions.

So, it’s highly recommended that the organizations must remain proactive, regularly update security protocols to defend against these sophisticated cyber threats.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

The post APT43 Hackers Attacking Academic Institutions With Exposed Credentials appeared first on Cyber Security News.