Risky Bulletin: North Korean IT worker scams expand to Europe

Summary

Risky Bulletin: North Korean IT Worker Scams Expand to Europe
Hosted by risky.biz
Release Date: April 2, 2025

In this episode of Risky Bulletin, host Claire Airdrie delves into a multitude of pressing cybersecurity issues, ranging from sophisticated North Korean scams to significant vulnerabilities in major technology infrastructures. The bulletin is meticulously prepared by Catalyn Kimparnu and delivered with clarity by Claire. Below is a comprehensive summary of the episode, highlighting key discussions, insights, and conclusions along with notable quotes.

---

1. North Korean IT Worker Scams Expand to Europe

Timestamp: [00:04]

Claire opens the episode by addressing the alarming expansion of North Korea's deceptive IT worker schemes into the European job market. Following a successful crackdown by US authorities on North Korean laptop farms last year, these malicious operations have pivoted westward.

• Global Expansion of Scams: Google has identified a dozen fake personas specifically tailored for European employment sectors. Additionally, a suspected laptop farm operating out of London has been uncovered.

• Scale of Operations: A significant cluster of nearly 24,000 IP addresses has been detected scanning for Palo Alto Network's Global Protect VPN login pages. Security firm Greynoise attributes these scans as potential preludes to more extensive exploitation attempts.

Claire reports, “Google says North Korea's scheme to get fake IT workers hired by Western firms has spread to Europe,” emphasizing the transnational nature of these cyber threats.

---

2. Targeted Scanning of Palo Alto Networks’ VPNs

Timestamp: [00:04]

The episode highlights the vulnerability of Palo Alto Networks' Global Protect VPN gateways, which have recently been the focus of extensive scanning activities.

• Potential Exploitation: With multiple vulnerabilities disclosed in recent months, the ongoing scans by nearly 24,000 IPs could signify imminent exploitation efforts.

• Expert Insight: Greynoise's analysis suggests that these scans are a strategic precursor to future cyberattacks, potentially compromising secure networks worldwide.

---

3. Gmail Enhances Security with End-to-End Encryption for Enterprise Users

Timestamp: [00:04]

In a significant development for email security, Google is rolling out end-to-end encrypted emails for Gmail's enterprise clients.

• Seamless Integration: The new encryption feature is being introduced without the need for additional software or complex configurations, making it user-friendly.

• Rollout Plan: Currently in beta, the encrypted email functionality will soon be available for internal Gmail communications, with plans to extend support to all email addresses by year's end.

Claire notes, “Google is adding support for end to end encrypted email for Gmail enterprise users,” highlighting Google's commitment to enhancing user privacy.

---

4. Massive Phishing Campaign Targets Coinbase Users

Timestamp: [00:04]

The podcast details a sophisticated phishing campaign that has resulted in the theft of over $100 million in cryptocurrency from Coinbase users since December.

• Attack Mechanics: Cybercriminals have been deploying deceptive phishing tactics, leading to significant financial losses. One notable incident involved a single user losing approximately $35 million worth of Bitcoin.

• Investigator's Report: Blockchain investigator Zac XBT confirms the alarming scale of these phishing operations, indicating a well-coordinated effort to exploit Coinbase's user base.

Claire emphasizes, “Hackers steal over $100 million via Coinbase phishing,” underscoring the severity of the threat to cryptocurrency investors.

---

5. DDoS Attacks Disrupt Russian Transportation Systems

Timestamp: [00:04]

The episode moves on to discuss cyberattacks targeting Russia's state-owned railway and Moscow's subway systems.

• Impact of the Attacks: These Distributed Denial of Service (DDoS) attacks rendered ticket purchasing applications and websites inoperative, causing significant disruptions for travelers.

• Attribution: Ukrainian hacktivist groups are believed to be behind these retaliatory attacks, responding to a recent Russian cyber operation that crippled Ukraine's railway infrastructure.

---

6. Extension of US Cyber National Emergency Executive Order

Timestamp: [00:04]

The White House has extended an executive order initially signed by President Barack Obama in 2015, which declares a cyber national emergency.

• Scope of the Order: This extension empowers US government agencies to impose sanctions on foreign hackers and entities that support their malicious operations.

• Significance: The continuation of this order reinforces the United States' stance on proactively combating cyber threats from hostile foreign actors.

Claire remarks, “The White House has extended an executive order that declared a cyber national emergency,” highlighting the ongoing commitment to national cybersecurity.

---

7. Apple Penalized by French Regulators Over Privacy Features

Timestamp: [00:04]

French authorities have imposed a hefty fine of 150 million euros on Apple, citing that its iOS privacy feature is detrimental to competition.

• Reason for the Fine: The App Tracking Transparency framework implemented by Apple generates excessive consent pop-ups, complicating the usage of non-Apple applications and adversely affecting app developers and online advertisers.

• Regulatory Perspective: The agency contends that these privacy measures, while well-intentioned, have unintended consequences that hinder fair competition in the digital marketplace.

---

8. Shutdown of OpenSNP Genetic Database Due to Security Concerns

Timestamp: [00:04]

OpenSNP, an open-source database housing genetic information, is set to cease operations by the end of April.

• Founder’s Statement: Bastian Zavares, the founder, expressed fears that emerging far-right governments might abuse the project's data. “I fear the project's data will be abused by emerging far right governments around the world,” Zavares stated.

• Usage Concerns: Contrary to initial scientific intentions, the platform's primary adopters have been law enforcement agencies, raising ethical and privacy concerns.

---

9. APIsec Suffers Data Leak Due to Unsecured Database

Timestamp: [00:04]

API testing company APIsec inadvertently exposed customer data by leaving an internal database unsecured on the internet without a password.

• Data Compromised: The leak included customer names, email addresses, credentials, and other sensitive technical details, alongside some APIsec employee information.

• Company Response: APIsec has since secured the database, although the breach underscores the critical importance of robust data security practices.

---

10. Mass Arrests of Foreign Nationals in Cambodian Cyber Scam Crackdown

Timestamp: [00:04]

Cambodian authorities have apprehended 186 foreign nationals, primarily Chinese and Taiwanese, suspected of running a large-scale cyber scam operation.

• Modus Operandi: Operating out of a sizable villa in Phnom Penh, the group targeted Chinese-speaking individuals through phone-based scams, leading to significant financial fraud.

• Law Enforcement Action: The arrests mark a substantial effort by Cambodian police to dismantle international cyber scam networks operating within their jurisdiction.

---

11. Slovenly Comet Exploits SMS Gateways to Hijack Accounts

Timestamp: [00:04]

A cybercriminal group named Slovenly Comet has been identified hacking into SMS gateways in Argentina to bypass multi-factor authentication (MFA) and seize user accounts.

• Targeted Services: The attacks focus on email platforms, cryptocurrency exchanges, messaging services like Telegram and Signal, and Latin American banks.

• Detection and Response: This malicious activity was uncovered by an organization specializing in cryptocurrency security incident investigations, highlighting the persistent threats in financial and communication sectors.

---

12. North Korean “Polite Hacking” Tactics Deployed Against Cryptocurrency Workers

Timestamp: [00:04]

North Korean hackers are reportedly employing a strategy termed “polite hacking,” which involves socially engineered tactics to entice individuals to inadvertently compromise their own systems.

• Methodology: These hackers utilize fake system warnings that persuade users to execute malicious commands on their Windows or macOS systems, facilitating the deployment of the Golanghost backdoor.

• Target Demographic: The campaign predominantly targets professionals in the cryptocurrency sector, aiming to infiltrate secure environments through deceptive job interview websites.

Claire explains, “North Korean hackers are luring people to fake job interview websites,” shedding light on the innovative and manipulative approaches used in modern cyber intrusions.

---

13. Critical Vulnerabilities Discovered in Brocade Fibre Channel Switches

Timestamp: [00:04]

Security researcher Pierre Kim has identified ten significant vulnerabilities in Brocade fibre channel switches, including pre-authentication and remote code execution flaws.

• Affected Devices: While seven of these vulnerabilities have been patched by Brocade, the remaining three will remain unaddressed as they pertain to end-of-life devices.

• Risk Implications: These unresolved vulnerabilities pose persistent security risks for organizations still utilizing these outdated switch models, potentially exposing them to unauthorized access and control.

---

14. Emergence of Advanced Triada Malware in Russian Android Devices

Timestamp: [00:04]

A new iteration of the Triada malware has been detected pre-installed on Android devices sold in Russia, enhancing its malicious capabilities.

• Capabilities of the New Triada: The malware can intercept calls, SMS messages, instant messages, and network traffic. Additionally, it has the ability to alter phone numbers and cryptocurrency addresses, facilitating scams and fund theft.

• Impact: This advanced version has already been linked to the theft of over $270,000 in cryptocurrency assets, demonstrating its potent threat to users.

---

Conclusion

Claire Airdrie wraps up the episode by reiterating the critical nature of the discussed cybersecurity threats and the evolving tactics employed by malicious actors globally. From state-sponsored schemes expanding across continents to sophisticated malware embedded in everyday devices, the bulletin serves as a stark reminder of the ever-present and dynamic landscape of cyber threats.

“And that is all for this podcast edition,” Claire concludes, emphasizing the importance of staying informed and vigilant in the face of such pervasive cyber risks.

---

Notable Quotes:

• “Google says North Korea's scheme to get fake IT workers hired by Western firms has spread to Europe.” — Claire Airdrie [00:04]

• “The White House has extended an executive order that declared a cyber national emergency.” — Claire Airdrie [00:04]

• “North Korean hackers are luring people to fake job interview websites.” — Claire Airdrie [00:04]

This episode of Risky Bulletin underscores the multifaceted challenges in the cybersecurity realm, urging organizations and individuals alike to bolster their defenses and remain proactive against emerging threats.

Transcript

[Claire Airdrie]

A North Korean IT worker scheme pivots to Europe After a US crackdown 24,000 IPs are looking for Palo Alto Network's VPNs, Gmail rolls out end to end encrypted emails for enterprise users and hackers steal over $100 million via Coinbase phishing. This is the Risky bulletin prepared by Catalyn Kimparnu and read by me, Claire airdrie. Today is the 2nd of April and this podcast episode is brought to you by Kroll. Find [e-mail] cyber Google says North Korea's scheme to get fake IT workers hired by Western firms has spread to Europe. The global expansion comes after US authorities cracked down on North Korean laptop farms last year. Google has identified a dozen fake Personas tailored for the European job market as well as a suspected laptop farm operating out of London. A cluster of almost 24,000 IP addresses have been scanning for the login pages of Palo Alto Network's Global Protect VPN gateways. Security firm Greynoise spotted the scans over the last month, which it says is likely a precursor to future exploitation. Multiple vulnerabilities in the Global Protect VPN have been disclosed in recent months. Cyber attacks have disrupted operations at Russia's state owned railway and the subway system in Moscow. Travellers were unable to purchase tickets as the apps and websites were down. Both incidents are believed to be DDoS attacks and the work of Ukrainian hacktivists. The attacks are likely retaliation for a Russian cyber attack that crippled Ukraine's state railway systems last week. The White House has extended an executive order that declared a cyber national emergency. The order allows US Government agencies to sanction foreign hackers and companies that aid their operations. The executive order was signed by President Barack Obama in 2015 and has been extended ever since it was set to expire on April 1st. Google is adding support for end to end encrypted email for Gmail enterprise users. The feature does not require additional software or configuration. Support for encrypted emails was rolled out in beta this week for Google customers. Internal emails Gmail users will be able to send encrypted emails to other Gmail users in the next few weeks and to any email address by the end of the year. French regulators have fined Apple 150 million euros because an iOS privacy feature is harming competition. The agency says the App Tracking Transparency framework displayed too many consent pop ups to users. Authorities said this made using non Apple apps excessively complex and harmed app developers and online advertisers. Open snp, an open source database of genetic information is shutting down. OpenSNP founder Bastian Zavares said he fears the project's data will be abused by emerging far right governments around the world. He said the project's biggest adopters were not scientific research groups but law enforcement agencies. The project plans to delete all user data at the end of April. API testing company apisec has leaked customer data after exposing an internal database on the Internet without a password. The database contained customer names, email addresses, credentials and other technical details. Some apisec employee details were also exposed. The company has since secured the database. Cambodian Police have arrested 186 foreign nationals who allegedly operated a cyber scam compound in the country's capital. The suspects were all Chinese and Taiwanese and operated out of a large villa in Phnom Penh. They targeted Chinese speakers in phone based scams. Hackers have stolen $46 million worth of crypto assets from Coinbase users in a phishing campaign over the last two weeks. One Coinbase user alone lost 400 Bitcoin worth around $35 million. According to blockchain investigator Zac XBT. Coinbase users have lost over $100 million to phishing scams since December. A group named Slovenly Comet has hacked SMS gateways in Argentina to bypass MFA and hijack user accounts. The HA was spotted by an organisation investigating cryptocurrency security incidents. The attackers targeted accounts for email, cryptocurrency, telegram signal and Latin American banks. North Korean hackers have adopted the polite hacking method, which means they're just asking people nicely to compromise themselves. The technique uses fake system warnings to trick users into pasting malicious commands into Windows or macOS command lines. SOC platform company Sequoia says North Korean hackers are luring people to fake job interview websites. The websites walk the hopeful candidates through a fake webcam setup procedure that involves running the commands. The malicious commands deploy a new cross platform backdoor named Golanghost. This campaign is targeting people working in cryptocurrency. Security researcher Pierre Kim has found 10 vulnerabilities in Brocade fibre channel switches. The issues include pre authentication, remote code execution flaws and devices shipping with hard coded device credentials. Brocade has patched seven of the bugs. The remaining three will not be patched because they impact end of life devices. And finally, a new version of the Triada malware has been spotted. Pre installed on Android devices being sold in Russia, the new version can intercept calls, SMS messages, instant messages and network traffic. It can also replace phone numbers and cryptocurrency addresses to scam users or steal their funds. The new version has already been linked to the theft of more $270,000 of crypto assets. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Kroll. Find [e-mail] cyber thanks to your company.