Microsoft says North Korean hacking groups have breached multiple Russian government and defense targets since the start of the year.
As the company claims in a report published today on threats from East Asia, the threat actors are taking advantage of Russia’s focus on the invasion of Ukraine to harvest intelligence from compromised Russian systems.
“Multiple North Korean threat actors have recently targeted the Russian government and defense industry – likely for intelligence collection – while simultaneously providing material support for Russia in its war on Ukraine,” said Clint Watts, the head of Microsoft’s Digital Threat Analysis Center.
Microsoft is yet to provide further details regarding these attacks, such as what Russian organizations were breached, but the company’s report does provide insight into when some of the attacks occurred.
One Russian aerospace research entity and Russian diplomatic accounts were all hacked this March, according to Redmond.
“In March 2023, Ruby Sleet compromised an aerospace research institute in Russia. Additionally, Onyx Sleet (PLUTONIUM) compromised a device belonging to a university in Russia in early March,” the Microsoft Threat Intelligence team said.
“Separately, an attacker account attributed to Opal Sleet (OSMIUM) sent phishing emails to accounts belonging to Russian diplomatic government entities during the same month.”
North Korean cyberattacks orchestrated by threat groups tracked as Ruby Sleet (aka CERIUM) and Diamond Sleet (aka ZINC and Lazarus) have also extended their scope to include arms manufacturers in various nations, which notably include Germany and Israel.
Defense firms in Brazil, Czechia, Finland, Italy, Norway, and Poland have also been subject to these intrusions, all as part of a coordinated endeavor to enhance the country’s military capabilities.
“From November 2022 to January 2023, Microsoft observed a second instance of targeting overlaps,…
read more www.bleepingcomputer.com
