North Korean hackers attack South Korea’s construction sector
The Kimsuky hacker group distributed malware through the website of a professional association in the construction sector, according to the South Korean intelligence.
The malware was hidden in the security authentication software used to log into the website. As a result, the personal computers of local government, public institutions, and construction company staff who accessed the website were infected.
It is believed that the attackers exploited a file upload vulnerability on the professional association's website to alter the security authentication software in a “meticulously” planned operation. “It is presumed that the hackers aimed to use the compromised credentials of officials in the construction sector as a foothold to steal critical information about major construction projects and technical data from companies involved,” the KCIC said.
Type of Malware
Threat Source
Impacts
IT