North Korea-Linked Covellite APT group stopped targeting organizations in the U.S.
6.6.2018 securityaffairs APT

A North Korea-linked APT group, tracked by experts at industrial cybersecurity firm Dragos as Covellite, has stopped targeting US organizations.
Anyway, the group, that is believed to be linked to the notorious Lazarus APT group, is continuing to target organizations in Europe and East Asia.

The group has been around at least since 2017 and is still active, the APT has targeted civilian electric energy organizations to steal intellectual property and gather intelligence on industrial operations.

Differently, from other threat actors that are focused on industrial control systems, Covellite seems to be not interested in sabotage.

In September 2017, experts from FireEye spotted a wave of attacks launched by the APT group against U.S. electric companies, the phishing messages used weaponized Word documents to deliver a piece of malware.

“COVELLITE compromises networks associated with civilian electric energy worldwide and gathers intelligence on intellectual property and internal industrial operations. COVELLITE lacks an industrial control system (ICS) specific capability at this time.” reads the post published by Dragos.

“COVELLITE operates globally with targets primarily in Europe, East Asia, and North America. US targets emerged in September 2017 with a small, targeted phishing campaign directed at select U.S. electric companies.”

The experts linked the attacks to Pyongyang and confirmed that the group did not show the ability to disrupt power supply.

Covellite

According to Dragos, the infrastructure and the malicious code used by the COVELLITE group are similar to the ones used by the LAZARUS APT GROUP, aka Hidden Cobra.

“technical analysis of COVELLITE malware indicates an evolution from known LAZARUS toolkits. However, aside from technical overlap, it is not known how the capabilities and operations between COVELLITE and LAZARUS are related.” continues the post.

“Given the group’s specific interest in infrastructure operations, rapidly improving capabilities, and history of aggressive targeting, Dragos considers this group a primary threat to the ICS industry,”

Dragos experts have recently published reports on other hacker groups focused on ICS and SCADA systems, including Iran-linked Chrysene, Russia-linked Allanite, and Xenotime.