Nation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions

on YouTube ↗55m

" summary

Four documented campaigns show Lazarus, Bluenoroff, Andariel and Reaper pivoting to theft: a VDI named‑pipe VDI escape lets Manuscript crawl VLANs to harvest SWIFT hosts; an ATM operation uses a zero‑day AV exploit plus misconfigured FTP and exfiltrates 1.9 million card records from 60 ATMs infected; Bitcoin exchange spear‑phishing leverages Ghostscript/CVE‑style HWP and CVE‑2017‑0199 DOCX chains; C2s are mostly compromised hosts and attackers even collect mining payouts.

AI-written summary · about

" chapters (18)

1. 0:00Intro
2. 3:05BACKGROUND - who are they?
3. 5:59BACKGROUND - Activity Timeline
4. 7:44KOREA MAJOR BANK ATTACK BY BLUENOROFF - Background
5. 9:24KOREA MAJOR BANK ATTACK BY BLUENOROFF - Attack Vector
6. 11:02KOREA MAJOR BANK ATTACK BY BLUENOROFF - Malware
7. 16:24VANXATM - ATM OPERATOR COMPANY BREACH
8. 25:00BITCOIN EXCHANGES HACKING CAMPAIGN
9. 28:15BITCOIN EXCHANGES HACKED - Phishing Email Attack Vector
10. 29:18BITCOIN EXCHANGES HACKED - Attack Timeline
11. 39:06INTERESTING ATTACK TARGETED BANK IN EGYPT - Background
12. 41:34Campaign targeted Egypt bank and SK banks - Delivery Method
13. 45:40Campaign targeted Egypt bank and SK banks - Interesting Decoys
14. 48:02Directory browsing open on C&C server
15. 49:20Getting new C&C server with (stolen? ransomed?) bitcoin
16. 50:23USING MONERO MINER
17. 53:12Sample Timestamp Analysis of Andariel Group (GMT+9)
18. 53:52BLACK HAT SOUND BYTES (CONCLUSION)

" related talks

• 01h 02mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial InstitutionsChi-en (Ashley) Shen, Kyoung-ju Kwak, Min-Chang Jang · Black Hat Europe 2017
• 25mGlobal Threat Brief: Hacks and Adversaries UnveiledDmitri Alperovitch, Sandra Joyce · RSAC Conference 2021
• 46mAttacks, Lies and the Underground WorldAndrea Pompili · Codemotion Amsterdam 2016
• 42mTracking Attackers in Open Source Supply Chain Attacks: The New FrontierTzachi ( Zack) Zorenshtain · SupplyChainSecurityCon at Open Source Summit Europe 2022
• 37mTo Loot or Not to Loot? That Is Not a Question When State Nexus APT Targets Online EntertainmentCharles Li, Che Chang · Black Hat Asia 2022
• 31mThe Wolves Among Us… A Tale of APT’s ThieveryStefano Maccaglia · RSAC 2020 Asia Pacific & Japan
• 54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPsDmitry Bestuzhev, Ismael Valenzuela Espejo · RSA Conference 2023
• 32mOperation Clairvoyance: How APT Groups Spy on the Media IndustryYue-Tien Chen, Zih-Cing Liao (DuckLL) · Black Hat Asia 2023