<p>A highly sophisticated malware campaign called GuptiMiner has emerged, orchestrated by a threat actor possibly affiliated with North Korean APT group Kimsuky. This campaign takes advantage of an antivirus update mechanism to distribute backdoors and coinminers. The malware employs various techniques, including an infection chain, DNS requests to attacker’s servers, sideloading, and payload extraction from innocent-looking images. Infected devices are targeted with the XMRig coinminer. GuptiMiner evolves over time, incorporating advanced obfuscation techniques and anti-VM measures. It even deploys a customized version of PuTTY Link for local SMB network scanning and lateral movement across Windows 7 and Windows Server 2008 systems. Notably, the backdoor is deployed on devices connected to large corporate networks. Recently, suspected North Korean hackers executed a man-in-the-middle attack against eScan, an Indian software security company. This attack deceived victim’s machines into communicating with a malicious update server, ultimately downloading the GuptiMiner malware. The malware is highly sophisticated and employs multiple tactics to hide its traffic and evade detection. Linked to the North Korean state-sponsored hacking group, Kimsuky, the campaign highlights the growing threat of malware exploits and the need for robust security measures.</p>


Collections

A sophisticated malware campaign called GuptiMiner, possibly orchestrated by North Korean APT group Kimsuky, exploits antivirus updates to distribute backdoors and coinminers. The campaign employs various techniques, targets corporate networks, and highlights the need for robust security measures.

GuptiMiner: North Korean Hackers Exploit Antivirus Updates to Distribute Backdoors and Coinminers