As Kim Jong Un became the first North Korean leader to step into South Korea, his generals continue to oversee teams of increasingly advanced hackers who are actively targeting the financial, health, and entertainment industries in the US and more than a dozen other countries. The so-called GhostSecret data reconnaissance campaign,
exposed Tuesday by security firm McAfee, remains ongoing. It is deploying a series of previously unidentified tools designed to stealthily infect targets and gather data or possibly repeat the same type of
highly destructive attacks visited upon Sony Pictures in 2014.
Last month, McAfee
reported finding Bankshot, a remote-access trojan attributed to Hidden Cobra—a so-called advanced persistent threat group tied to North Korea—infecting Turkish banks. In this week's report, the security firm said the same malware was infecting organizations all over the world. McAfee researchers also found never-before-seen malware that was infecting the same organizations. One tool included many of the capabilities of Bankshot, including its ability to compromise computers that connect to the SWIFT banking network and permanently wipe data from infected computers. The tool also had digital fingerprints found in Destover, the name given to malware that was used in the Sony Pictures intrusion
"This analysis by the McAfee Advanced Threat Research team has found previously undiscovered components that we attribute to Hidden Cobra, which continues to target organizations around the world," McAfee researchers Ryan Sherstobitoff and Asheer Malhotra wrote in Tuesday's post. "The evolution in complexity of these data-gathering implants reveals an advanced capability by an attacker that continues its development of tools."
It's not particularly surprising that North Korea, or any other nation, would continue to spy on countries even as it makes public overtures for peace.
"It would be highly unusual for any country to cease intelligence gathering operations in the midst of some of the most important talks in their history," Sergio Caltagirone, director of threat intelligence at security firm Dragos, told Ars. Previously, he was a senior threat intelligence analyst at the US National Security Agency. "In fact, we would expect espionage activity to grow during periods of negotiation."