North Korean hacking group RedEyes utilizes a new info-stealer called “FadeStealer”

With the ever-increasing threat of cyberattacks from various state-sponsored hacking groups, security researchers have identified a new info-stealer being used by the North Korean hacking group RedEyes. The group, also known as APT37, ScarCruft, and Reaper, has been active for nearly a decade and is affiliated with North Korea’s Ministry of State Security (MSS).

New Info-Stealer “FadeStealer”

AhnLab Security, a South Korean cybersecurity company, recently identified a new info-stealer being used by the North Korean hacking group RedEyes. Dubbed “FadeStealer,” this malware has exceptional features that allow threat actors to eavesdrop and capture audio through victims’ microphones. This new capability adds to the already extensive set of tools RedEyes employs for cyber espionage attacks.

Active since 2012, RedEyes is believed to be a state-sponsored APT group affiliated with North Korea’s Ministry of State Security (MSS). The group has been implicated in numerous cyber espionage attacks aligned with North Korea’s interests. Its focus areas include North Korean traitors and EU-based organizations.

Reported Incident

According to Cyber Security News, RedEyes recently carried out another cyber espionage attack. The group has been known for their long-standing involvement in cyber espionage attacks and this particular incident is believed to align with North Korea’s interests. The report did not disclose the targeted organization or the specifics of the attack.

The first breach in this particular cyber espionage attack was executed by the threat actor through the use of a CHM file. The file was probably part of a phishing email campaign that urged people to open it to obtain a document password, which ultimately infected their Windows computer with malware.

Backdoor Deployment

Later phases of the attack involved the deployment of an additional GoLang backdoor through another backdoor that was initially breached. This backdoor serves the purpose of allowing the threat actor access to the victim’s system and providing persistence for future attacks.

The North Korean hacking group utilized DLL sideloading, a technique that involves injecting malicious code into an already running legitimate process. In this case, the attackers used the legitimate Internet Explorer process called “ieinstal.exe,” and with the help of DLL sideloading, they injected the FadeStealer malware after installation.

Multiple threat actors utilize CHM files. While RedEyes (also known as APT37, ScarCruft, and Reaper) is one of the North Korean threat actors to use CHM files to distribute malware, it is not alone. Other North Korean threat actors also use this method. This technique is particularly effective, as CHM files are often considered trusted files and are not usually flagged by antivirus software.

As state-sponsored hacking groups continue to develop new and more potent malware, it is critical for organizations to stay vigilant and up-to-date on the latest threats. The deployment of unique malware like FadeStealer by RedEyes highlights the group’s growing capabilities and emphasizes the need for robust cybersecurity measures to keep sensitive data and systems secure.

Explore more

Why is LinkedIn the Go-To for B2B Advertising Success?

In an era where digital advertising is fiercely competitive, LinkedIn emerges as a leading platform for B2B marketing success due to its expansive user base and unparalleled targeting capabilities. With over a billion users, LinkedIn provides marketers with a unique avenue to reach decision-makers and generate high-quality leads. The platform allows for strategic communication with key industry figures, a crucial

Endpoint Threat Protection Market Set for Strong Growth by 2034

As cyber threats proliferate at an unprecedented pace, the Endpoint Threat Protection market emerges as a pivotal component in the global cybersecurity fortress. By the close of 2034, experts forecast a monumental rise in the market’s valuation to approximately US$ 38 billion, up from an estimated US$ 17.42 billion. This analysis illuminates the underlying forces propelling this growth, evaluates economic

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Embedded Finance Ecosystem – A Review

In the dynamic landscape of fintech, a remarkable shift is underway. Embedded finance is taking the stage as a transformative force, marking a significant departure from traditional financial paradigms. This evolution allows financial services such as payments, credit, and insurance to seamlessly integrate into non-financial platforms, unlocking new avenues for service delivery and consumer interaction. This review delves into the

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.