In a troubling development, hackers from North Korea have reportedly compromised software utilized by thousands of companies across the United States. The aim of this cyber attack appears to be the acquisition of stolen cryptocurrency, which may be used to finance the nation's nuclear and missile development programs. As of now, 135 devices across 12 different companies have been confirmed as compromised, but the actual number of victims could be much higher. Experts predict that the complete investigation and recovery process could take several months.

The malicious tool targeted in this incident is Axios, a widely used open-source JavaScript library that developers rely on for managing HTTP requests. The North Korean hacking group exploited vulnerabilities in the software, gaining backdoor access to the operating systems of the companies affected. The two versions of Axios that were compromised are reportedly downloaded over 183 million times each week, leaving those who downloaded the software during the attack period vulnerable to exploitation.

While the full ramifications of this breach will take time to fully ascertain, initial assessments suggest that hundreds of thousands of sensitive company secrets may have already been compromised, placing this incident among the most severe data breaches on record.

Why is North Korea Targeting U.S. Companies?

The hacking group believed to be responsible for this breach is identified as UNC1069. Since 2018, this group has focused primarily on attacks against the financial sector. According to Charles Carmakal, Chief Technology Officer at Mandiant, "We anticipate they will try to leverage the credentials and system access they recently obtained in this software supply chain attack to target and steal cryptocurrency from enterprises." This insight underscores the potential for further exploitation in the wake of this breach.

Cybercrime has become a significant source of income for North Korea, primarily funding its nuclear and missile initiatives. Current estimates indicate that approximately half of the country’s missile program is financed through hacking activities. In recent years, North Korean hackers have successfully pilfered billions of dollars from cryptocurrency exchanges and banking institutions. Notably, they executed a record-breaking theft of $1.5 billion in cryptocurrency in a single operation last year.

This latest hacking incident is considered one of the most sophisticated supply chain attacks to date. The attackers employed advanced techniques, including the deletion of their own tracks after delivering the malicious payload to the victim's systems. Such tactics have made it exceedingly difficult for developers to detect the compromised software that was innocently downloaded.

Currently, it appears that UNC1069 is not making efforts to conceal their activities; rather, they seem focused on maximizing their gains before facing potential identification and repercussions. The cybersecurity community continues to monitor the situation closely, anticipating further developments as investigations unfold and the extent of the breach becomes clearer.

In light of this breach, companies are urged to reassess their cybersecurity protocols and ensure that software systems are secure and up to date. The potential loss of sensitive data and the financial implications of such a breach could have long-lasting effects on the affected companies, as well as on the broader industry.

Source: SlashGear News