North Korean Hackers Unleashed Chrome 0-Day Exploit on Hundreds of US Targets
upstart writes:
North Korean hackers unleashed Chrome 0-day exploit on hundreds of US targets:
Hackers backed by North Korea's government exploited a critical Chrome zero-day in an attempt to infect the computers of hundreds of people working in a wide range of industries, including the news media, IT, cryptocurrency, and financial services, Google said Thursday.
The flaw, tracked as CVE-2022-0609, was exploited by two separate North Korean hacking groups. Both groups deployed the same exploit kit on websites that either belonged to legitimate organizations and were hacked or were set up for the express purpose of serving attack code on unsuspecting visitors. One group was dubbed Operation Dream Job, and it targeted more than 250 people working for 10 different companies. The other group, known as AppleJeus, targeted 85 users.
"We suspect that these groups work for the same entity with a shared supply chain, hence the use of the same exploit kit, but each operate with a different mission set and deploy different techniques," Adam Weidemann, a researcher on Google's threat analysis group, wrote in a post. "It is possible that other North Korean government-backed attackers have access to the same exploit kit."
[...] The exploit kit was written in a way to carefully conceal the attack by, among other things, disguising the exploit code and triggering remote code execution only in select cases. The kit also appears to have used a separate exploit to break out of the Chrome security sandbox. The Google researchers were unable to determine that escape code, leaving open the possibility that the vulnerability it exploited has yet to be patched.
Read more of this story at SoylentNews.