Read on Twitter
Today, we've released #APT43 🇰🇵. As part of this release, I wanted to highlight some of the background research that went into this. No blue checkmark, so I have to do a normal thread 😅mandiant.com/resources/blog…
Many groups are defined in reports as prolific. What does that really mean? #APT43 started as #UNC1130. we're now in the 4000s+ for UNCs. They've been around the block. Not only that, but the rate at which they spin up infrastructure is impressive.
Through our approach of Continuous Visibility on targets, we have nearly 200 signals deployed for this group alone, with a vast majority aiming to identify suspected infrastructure. We are looking at potential new domains nearly everyday.
Yes this is all normal sounding threat research, but the systematic collection and analysis is especially important for groups that have less prominent hands-on ops, and is what led to some of the more fun finds.
In the report, we detail the deep rapport building between #APT43 and victims. I've seen a number of org victim notifications in my time, but notifying an individual to ignore an email that has just hit their inbox minutes ago sparks joy.
I highly recommend listening to the podcast where @j3nnyt0wn is interviewed, a common #APT43 target and a persona they have attempted to masquerade as. mandiant.com/resources/podc…
Most notably, #APT43 buys hash rental and cloud mining services to provide hash power, effectively allowing them to use stolen crypto to mine clean crypto🧼 It's not often that you get this type of visibility on this aspect of a cyber operation.
As part of this research, we've also looked deeper into North Korea-adjacent activity that shows their ardent desire to continue to evolve towards the blockchain. I'm excited to see how CTI will evolve to systematically track this.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
