Acronis identifies new global campaigns linked to the North Korean groups Lazarus and Kimsuky
The research conducted by Acronis TRU and Hunt.io made it possible to reconstruct and correlate active infrastructures used by North Korean actors, revealing recurring operational patterns, malware variants and shared techniques to track operations even when the payloads vary
Acronis, global leader in the cybersecurity and in the data protection, announces that the Acronis Threat Research Unit (TRU) conducted, together with Hunt.io, new research that allowed us to identify and correlate active infrastructures attributable to groups of cyber attackers linked to North Korea (DPRK), including Lazarus Group and Kimsuky, revealing global campaigns that are still operational and so far not publicly linked to each other.
Hunt.io is a platform specialized in threat intelligence and infrastructure analysis, focused on identifying and tracking the activities of malicious actors by observing exposed assets, servers, digital certificates and provisioning patterns. Thanks to its large-scale correlation and pivoting capabilities, Hunt.io supports security teams in identifying hostile infrastructures even in the preliminary stages of campaigns, before direct impacts on endpoints are observed. The collaboration with the Acronis Threat Research Unit is part of the TRU Alliance, with the aim of sharing in-depth analyzes and operational guidance for the benefit of the defense community.
The analysis highlights how DPRK actors continue to rely on recurring infrastructure patterns, regardless of the evolution of the malware used. Staging servers with exposed directories, credential theft toolkits, Fast Reverse Proxy tunnels, and reused digital certificates are key elements of an operational model that remains stable over time and allows you to connect seemingly distinct activities.
During the investigation, a new Linux variant of the Badcall backdoor was also identified, previously associated with operations attributed to the Lazarus group. The changes found indicate an evolution aimed at improving operational efficiency and internal monitoring of malicious activities, confirming continuous work to refine the tools available to attackers.
The research also uncovered infrastructures dedicated to credential theft and exfiltration, often hosted on temporary servers and characterized by publicly accessible directories containing large sets of offensive tools. These environments, used as support nodes during intrusions, can be traced back to patterns already observed in previous DPRK campaigns.
A further element that emerged concerns the systematic use of FRP tunneling components, distributed uniformly across multiple hosts and providers. This technique allows you to maintain reliable command and control channels even in the presence of network limitations or blocking attempts, and the repetition of the same configurations represents a relevant signal for the early identification of new malicious infrastructures.
The analysis shows how, beyond the individual campaigns, there is a shared operational ecosystem within the DPRK ecosystem, characterized by consolidated technical habits and coordinated management of infrastructure resources. This approach gives security teams reliable indicators to intercept hostile activities already in the preparatory stages, before they translate into concrete attacks.
The analysis activity was also supported by findings at the detection level, which allowed us to observe behaviors consistent with those described in the investigation from the point of view of the endpoints. The protection, detection and response capabilities integrated into Acronis solutions made it possible to intercept the use of backdoors, credential theft tools and command and control infrastructures attributable to the analyzed campaigns, confirming the effectiveness of an approach based on the correlation between endpoint telemetry and infrastructure observation. This allows security teams to gain greater visibility into hostile activity and intervene more quickly even in the early stages of attacks.
The research confirms how the continuous monitoring of infrastructures, digital certificates and server provisioning patterns represents today one of the most effective tools to counter persistent and structured APT operations, allowing a more proactive approach to defense against threats on a global scale.
A full breakdown of the research conducted by Acronis Threat Research Unit and Hunt.io is available here link
