McAfee suspects North Korea for Cyberattacks on the financial sector in Turkey

On 8th March 2018, in an interview, McAfee reported that they suspect North Korean hackers for the cyber-attack on Turkey’s financial sector. On 27^th December 2017, the  US Government had published the warning of Bankshot malware, that a group of hackers, Hidden cobra was attached to the malignant cyber-criminals who are working for the North Korean Government.

Even the similar accusation was made by South Korean, for hacking their cryptocurrency exchanges. Although the international sanctions were tight up against the country, over the past years.

For violating the security of Turkish government-backed financial sector on 2^nd and 3^rd March, McAfee Advanced Threat Research team has hacked Hidden Cobra group, after they suspect an attempt from their side.

Although McAfee policy wasn’t to officially identify the cyber groups from the state. That’s why they have mentioned in the report about the code of the malware, in question is actually somewhat matches with the hacking operative associated with North Korea.

The report says that the file shown up was an agreement template for Bitcoin distribution between an unknown person in Paris, are yet to be confirmed by cryptocurrency Exchange. 

The hackers have tried to attack the victims with the phishing emails that contain the infected MS-Word file name Agreement.docx. The malware Bankshot which uses the vulnerability in Adobe Flash, as mentioned recently was used by the hackers.

 Bankshot regulation was distributed from the domain which is similar to Falcon Coin lending platform- cryptocurrency. The malignant domain Falconcoin.io was established on 27^th December 2017 and aren’t attached to the original platform, legally.

The report didn’t reveal which particular organizations were attacked. Although, there is no news of stolen money in the attack. But the research team thinks that the attack was targeted to just get the remote access to the internal systems of the government-controlled financial sector.

McAfee Activate team has encountered with the two documents, which are written in the Korean language and it seems to be the part of the same hacking institution but used for different targeted purposes.

Source: http://mcafee.coms-setup.com/mcafee-suspects-north-korea-for-cyberattacks/