Targeted by North Korean cyber spies, infosec pros in bullseye

A hacking unit from North Korea’s Ministry of State Security, known as ScarCruft, has been targeting media organizations, high-profile experts, and potentially cybersecurity researchers, according to a report from SentinelLabs. The unit has been using phishing emails to install the RokRAT backdoor onto the devices of its targets. The report also found that the hackers were using a technical research report on a long-running North Korean hacking campaign as a decoy, indicating that they may be planning to target cybersecurity professionals in future campaigns. The approach of using decoy documents is a known tactic among North Korean hackers. The ongoing campaigns and the testing-phase malware demonstrate the hackers’ commitment to gathering strategic intelligence through targeted attacks.