@BushidoToken Threat Intel

  Introduction The BBC World Service has recently produced The Lazarus Heist podcast (available here ), researched and presented by Geoff White and  Jean H. Lee . This thrilling podcast dives into the intracacies of the elaborate Bangladesh Bank heist attempt to steal $1 billion. As a security researcher that actively tracks the Lazarus group and any mentions of North Korean cyber activity, I found this podcast series was extremely detailed and well researched. There are so many additional info gems that anyone who has researched North Korea will enjoy. I also highly recommend it for any threat intelligence analysts investigating North Korean cyber activity.  The Lazarus Heist podcast also made me want to revisit what I have learned about North Korean advanced persistent threat (APT) groups. In February 2020, I blogged about who the Lazarus group is and what campaigns they are known for (see here ). This was one of my first blogs and I was eager to learn more while resea...

  In 1937, one of the world’s most authoritative art historians, Abraham Bredius, was approached by a lawyer on behalf of a Dutch family estate to inspect a painting of a Christ and the Disciples at Emmaus (pictured above). Bredius dedicated many years of his life studying the artwork of Johannes Vermeer. After inspecting the painting, he wrote that it is not only a Vermeer, but one the greatest pieces Vermeer ever created. Han Van Meegeren, a mediocre Dutch artist, had in fact forged the work of Vermeer. The above piece was sold during WWII to Nazi Field-Mashal Hermann Goering. Van Meegeren was charged as a Nazi collaborator, but claimed he was national hero. This was because he traded the forgery for 200 original Dutch paintings seized by Goering at the beginning of the war.  To fool Abraham Bredius, the 83 year old art historian whose words were taken as gospel, Van Meegeren had to lay as many clues (or false flags) as he could. This involved making a new painting look like...

UPDATE - 29.06.2022: On 28 June 2022, NKNews.org cited this blog in their research on DarkHotel. In November 2021, I decided to revisit this blog and rethink some of the things I said. Parts of this blog are not what I would currently consider analytically sound. This was written over 2 years ago and my skills and my perspective on this group have changed a lot since then. 📝 I decided to review and rethink some of the things I wrote in one of my more popular blogs, which was received well(ish) but was not what I would currently consider analytically sound. This was written nearly 1.5 yrs ago and my perspective has changed 1/7 https://t.co/Nk3amxHHiQ — Will (@BushidoToken) November 29, 2021 Originally published on 14.06.2020 PART 1: DARKHOTEL DarkHotel is a sophisticated and active advanced persistent threat (APT) group. It’s highly capable and is known for finding and taking advantage of previously unknown vulnerabilities in common software also known as a 0day. It is a well-est...