North Korean hacking group RedEyes utilizes a new info-stealer called “FadeStealer”

With the ever-increasing threat of cyberattacks from various state-sponsored hacking groups, security researchers have identified a new info-stealer being used by the North Korean hacking group RedEyes. The group, also known as APT37, ScarCruft, and Reaper, has been active for nearly a decade and is affiliated with North Korea’s Ministry of State Security (MSS).

New Info-Stealer “FadeStealer”

AhnLab Security, a South Korean cybersecurity company, recently identified a new info-stealer being used by the North Korean hacking group RedEyes. Dubbed “FadeStealer,” this malware has exceptional features that allow threat actors to eavesdrop and capture audio through victims’ microphones. This new capability adds to the already extensive set of tools RedEyes employs for cyber espionage attacks.

Active since 2012, RedEyes is believed to be a state-sponsored APT group affiliated with North Korea’s Ministry of State Security (MSS). The group has been implicated in numerous cyber espionage attacks aligned with North Korea’s interests. Its focus areas include North Korean traitors and EU-based organizations.

Reported Incident

According to Cyber Security News, RedEyes recently carried out another cyber espionage attack. The group has been known for their long-standing involvement in cyber espionage attacks and this particular incident is believed to align with North Korea’s interests. The report did not disclose the targeted organization or the specifics of the attack.

The first breach in this particular cyber espionage attack was executed by the threat actor through the use of a CHM file. The file was probably part of a phishing email campaign that urged people to open it to obtain a document password, which ultimately infected their Windows computer with malware.

Backdoor Deployment

Later phases of the attack involved the deployment of an additional GoLang backdoor through another backdoor that was initially breached. This backdoor serves the purpose of allowing the threat actor access to the victim’s system and providing persistence for future attacks.

The North Korean hacking group utilized DLL sideloading, a technique that involves injecting malicious code into an already running legitimate process. In this case, the attackers used the legitimate Internet Explorer process called “ieinstal.exe,” and with the help of DLL sideloading, they injected the FadeStealer malware after installation.

Multiple threat actors utilize CHM files. While RedEyes (also known as APT37, ScarCruft, and Reaper) is one of the North Korean threat actors to use CHM files to distribute malware, it is not alone. Other North Korean threat actors also use this method. This technique is particularly effective, as CHM files are often considered trusted files and are not usually flagged by antivirus software.

As state-sponsored hacking groups continue to develop new and more potent malware, it is critical for organizations to stay vigilant and up-to-date on the latest threats. The deployment of unique malware like FadeStealer by RedEyes highlights the group’s growing capabilities and emphasizes the need for robust cybersecurity measures to keep sensitive data and systems secure.

Explore more

AI Revolutionizes Corporate Finance: Enhancing CFO Strategies

Imagine a finance department where decisions are made with unprecedented speed and accuracy, and predictions of market trends are made almost effortlessly. In today’s rapidly changing business landscape, CFOs are facing immense pressure to keep up. These leaders wonder: Can Artificial Intelligence be the game-changer they’ve been waiting for in corporate finance? The unexpected truth is that AI integration is

AI Revolutionizes Risk Management in Financial Trading

In an era characterized by rapid change and volatility, artificial intelligence (AI) emerges as a pivotal tool for redefining risk management practices in financial markets. Financial institutions increasingly turn to AI for its advanced analytical capabilities, offering more precise and effective risk mitigation. This analysis delves into key trends, evaluates current market patterns, and projects the transformative journey AI is

Is AI Transforming or Enhancing Financial Sector Jobs?

Artificial intelligence stands at the forefront of technological innovation, shaping industries far and wide, and the financial sector is no exception to this transformative wave. As AI integrates into finance, it isn’t merely automating tasks or replacing jobs but is reshaping the very structure and nature of work. From asset allocation to compliance, AI’s influence stretches across the industry’s diverse

RPA’s Resilience: Evolving in Automation’s Complex Ecosystem

Ever heard the assertion that certain technologies are on the brink of extinction, only for them to persist against all odds? In the rapidly shifting tech landscape, Robotic Process Automation (RPA) has continually faced similar scrutiny, predicted to be overtaken by shinier, more advanced systems. Yet, here we are, with RPA not just surviving but thriving, cementing its role within

How Is RPA Transforming Business Automation?

In today’s fast-paced business environment, automation has become a pivotal strategy for companies striving for efficiency and innovation. Robotic Process Automation (RPA) has emerged as a key player in this automation revolution, transforming the way businesses operate. RPA’s capability to mimic human actions while interacting with digital systems has positioned it at the forefront of technological advancement. By enabling companies