the same organization though embedded within the emails was a malicious microsoft word document the documents contained within its malevolent macros a macro in word is essentially just extra code contained within a document which automates certain tasks such as for fancy formatting for the most part macros are really pretty boring though they can be leveraged to run cursed code which is why word has them disabled by default when the victim tried opening the documents they were presented with this problem the macros wouldn't run discombobulated they responded to the email explaining the issue unaware that they were essentially pointing out to north korean hackers that their malicious code didn't run and asking them to fix it the attackers responded with another email explaining how to enable macros so the malicious code would work after a brief back and forth the attacker eventually realized that the tutorial they sent was for a different version of microsoft word than the victim had installed after some more to and fro the victim finally managed to enable macros and the malicious code ran frustratingly we don't know what the target company was here kaspersky has kept this confidential all we know is that the firm communicated in russian so on the balance of probability it was likely a russian company after successfully running the macro malware was deployed called threatneedle threatneedle was used to carry out initial reconnaissance and deploy yet more malware for lateral movements within the victim's computer system lateral movements in this context just refers to gaining further access and moving deeper within the victim network after the initial breach in the search of sensitive data to steal the hackers used an open source tool called responder to harvest credentials from the victim pc the infiltrators then used these grabs creds to gain access to other computers and eventually managed to compromise a computer used by system administrators from there they managed to find their way into a restricted network it's unclear exactly what was stored on this restricted network but it was valuable enough to warrant isolating it from the internet and from the main corporate network ironically for security reasons it's suggested in the reports that the main aim of this hack was to seal intellectual property given the compromised company is defense related one can only imagine what the target of this hack was once the hackers had found something worth stealing they reconfigured the company's router creating a tunnel to exfiltrate files out of that restricted network by all accounts it looks like the hackers were successful after grabbing what they came for the crooks started removing all traces of their activity from the victim computers setting up scripts to automatically delete log files the kaspersky reports details how through this investigation they managed to find connections to other hacks thought to be the work of north korea's lazarus group there's a lot of overlap here in the tools and scripts utilized in this hack compared to other recent acts this helps tie all of these different campaigns together and point the finger at lazarus lazarus are also said to be behind other major hacks such as wannacry and a billion dollar bank heist in a recent video i made which you should totally go and watch i discussed those hacks and the united states effort to bring the elusive group to justice speaking of things you should totally check out URL_TOKEN is the store i run where you can find an array of super cool pen testing products you can get NUMBER_TOKEN off with code satonic and i have something new coming to voltronics this weekend though if you follow me
START_SELFPROMO_TOKEN lazarus are also said to be behind other major hacks such as wannacry and a billion dollar bank heist in a recent video i made which you should totally go and watch i discussed those hacks and the united states effort to bring the elusive group to justice speaking of things you should totally check out URL_TOKEN is the store i run where you can find an array of super cool pen testing products you can get NUMBER_TOKEN off with code satonic and i have something new coming to voltronics this weekend though if you follow me END_SELFPROMO_TOKEN