North Korean Hackers Deploy Qilin Ransomware

Summary

Microsoft reveals that North Korean state-sponsored hackers, known as Moonstone Sleet, have started using Qilin ransomware. This marks a shift in their tactics, as they previously used only custom-built ransomware. This development raises concerns about the evolving ransomware landscape and the increasing collaboration between nation-state actors and ransomware-as-a-service operations.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

So, get this – Microsoft’s threat intelligence team just dropped a bombshell: North Korean hackers, specifically the crew known as Moonstone Sleet (formerly Storm-1789), are now using Qilin ransomware. You know, instead of just sticking to their own custom stuff. It’s the first time they’ve been caught using ransomware developed by a Ransomware-as-a-Service (RaaS) outfit. And honestly, it makes you wonder, doesn’t it, if this is the start of a bigger trend: nation-state actors cozying up to RaaS for their dirty work.

Moonstone Sleet: More Than Just Hackers

This group, Moonstone Sleet, isn’t just about the tech; they’re pretty savvy when it comes to social engineering. Their main goals are financial gain and, you know, a little cyberespionage on the side. They sneak in by using infected versions of regular programs, like PuTTY. Plus, they spread malicious games and even compromised npm packages, not to mention creating fake software companies to lure people in.

I remember reading about one of their fake companies; something like ‘C.C. Waterfall’ or ‘StarGlow Ventures.’ Pretty convincing stuff. They use these personas to connect with potential victims on LinkedIn, freelancing sites, Telegram, you name it. It’s a whole operation designed to get them inside target organizations.

Qilin Ransomware: The Rising Star (or Notorious Villain?)

Now, Qilin, these guys have been around since August 2022. Started out as ‘Agenda,’ and at first, they didn’t make much of a splash. But then, towards the end of 2023, things picked up. They launched a Linux encryptor aimed at VMware ESXi virtual machines. That got people’s attention. The ransom demands? They’re all over the place, anywhere from $25,000 to millions, depending on who they’re hitting. It’s opportunistic, I guess.

Some of their bigger scalps include Yangfeng, the automotive folks; Lee Enterprises, the newspaper publisher; and even Australia’s Court Services Victoria. But the one that really hit home was the attack on Synnovis. That caused chaos for NHS hospitals in London – hundreds of operations and appointments got canceled. Can you imagine?

North Korea: A History of Cyber Mischief

Let’s be real, Moonstone Sleet isn’t alone in this game. The Lazarus Group, another North Korean hacking crew, was behind the WannaCry ransomware attack in 2017. That was a global nightmare, crippling hundreds of thousands of computers. And more recently, back in 2022, Microsoft and the FBI pointed the finger at North Korean hackers for the Holy Ghost and Maui ransomware attacks, which mostly targeted healthcare orgs. Then, just this past May, Microsoft linked Moonstone Sleet to a custom FakePenny ransomware variant, after demanding a $6.6 million ransom after a successful attack.

What Does It All Mean?

So, here’s the takeaway: the partnership between Moonstone Sleet and Qilin is a sign of the times. We’re seeing nation-state actors teaming up with RaaS operations, and it’s not good. This combination – state-sponsored resources and RaaS infrastructure – makes for a potent threat. As Qilin and similar groups get more sophisticated, and their ties to nation-states get stronger, companies need to step up their cybersecurity game. Robust defenses and proactive threat intelligence are no longer optional; they’re essential. And, honestly, it’s a reminder that even in the digital world, who you know can be as important as what you know.