Fintech

North Korean hackers are targeting Brazilian fintech with sophisticated phishing tactics

Published

7 months ago

14 June, 2024

North Korea-related threat actors have accounted for a third of all phishing activity against Brazil since 2020, as the country’s emergence as an influential power has attracted the attention of cyber espionage groups.

“Actors supported by the North Korean government have targeted the Brazilian government and Brazil’s aerospace, technology and financial services sectors,” Google’s Mandiant and Threat Analysis Group (TAG) divisions said. She said in a joint report released this week.

“Similar to their targeting interests in other regions, cryptocurrency and financial technology companies have been the focus of attention, and at least three North Korean groups have targeted Brazilian cryptocurrency and fintech companies.”

Among these groups stands out a threat actor identified as UNC4899 (aka Jade Sleet, PUKCHONG, and TraderTraitor), which targeted cryptocurrency professionals with a Trojanized Python app packed with malware.

The attack chains involve reaching out to potential targets via social media and sending a benign PDF document containing a job description for a purported job opportunity at a well-known cryptocurrency company.

If the victim expresses interest in the job posting, the threat actor sends a second harmless PDF document with a skills questionnaire and instructions for completing a coding assignment by downloading a project from GitHub.

“The project was a Trojanized Python app for retrieving cryptocurrency prices that was modified to reach an attacker-controlled domain to retrieve a second-stage payload if specific conditions were met,” Mandiant and TAG researchers said.

This isn’t the first time UNC4899, attributed to the 2023 JumpCloud hack, has exploited this approach. In July 2023, GitHub warned of a social engineering attack that attempted to trick employees working at blockchain, cryptocurrency, online gambling, and cybersecurity companies into running code hosted in a GitHub repository using bogus npm packages.

Work-themed social engineering campaigns are a recurring theme among North Korean hacking groups, with the tech giant also spotting a campaign orchestrated by a group it monitors as PAEKTUSAN to deliver a C++ downloader malware called AGAMEMNON via Microsoft Word attachments embedded in phishing emails.

“In one example, PAEKTUSAN created an account impersonating a human resources director at a Brazilian aerospace company and used it to send phishing emails to employees of a second Brazilian aerospace company,” the researchers noted, adding that campaigns are consistent with a long-lasting activity tracked as Operation Dream Job.

“In a separate campaign, PAEKTUSAN masqueraded as a recruiter at a major U.S. aerospace company and contacted professionals in Brazil and other regions via email and social media about potential job opportunities.”

Google also said it blocked attempts by another North Korean group dubbed PRONTO to target diplomats with bait related to denuclearization and news to get them to visit credential harvesting pages or provide their login information to view a purported PDF document.

The development comes weeks after Microsoft shed light on a previously undocumented threat actor of North Korean origin, codenamed Moonstone sleetwhich has identified individuals and organizations in the software and information technology, education and defense sectors with both ransomware and espionage attacks.

Among Moonstone Sleet’s notable tactics is malware distribution through spoofed npm packages published on the npm registry, mirroring that of UNC4899. That said, the packages associated with the two clusters carry distinct code styles and structures.

“The Jade Sleet packages, discovered during the summer of 2023, were… designed to work in pairswith each pair published by a separate npm user account to distribute its malicious functionality,” Checkmarx researchers Tzachi Zornstein and Yehuda Gelb She said.

“In contrast, packages released in late 2023 and early 2024 took a leaner, single-package approach that ran their payload immediately upon installation. In Q2 2024, packages increased in complexity, with attackers adding obfuscation and also targeting Linux systems.”

Regardless of the differences, the tactic abuses the trust users place in open source repositories, allowing threat actors to reach a broader audience and increasing the likelihood that one of their malicious packages could be inadvertently installed by unwitting developers.

The revelation is significant, not least because it marks an expansion of Moonstone Sleet’s malware distribution mechanism, which previously relied on spreading fake npm packages using LinkedIn and freelancer websites.

The findings also follow the discovery of a new one social engineering campaign undertaken by countries linked to North Korea Kimsuky Group in which he reportedly impersonated the Reuters news agency to target North Korean human rights activists and spread information-stealing malware under the guise of an interview request. Genians.

Did you find this article interesting? Follow us on Twitter AND LinkedIn to read the most exclusive content we publish.

Source

Up Next

Too open to artificial intelligence? GFT advises caution against bank fraud

Don't Miss

JPMorgan, Greek fintech, claims success in court in London By Reuters

FinCrypto Staff

We are the editorial team of FinCrypto, where seriousness meets clarity in cryptocurrency analysis. With a robust team of finance and blockchain technology experts, we are dedicated to meticulously exploring complex crypto markets with detailed assessments and an unbiased approach. Our mission is to democratize access to knowledge of emerging financial technologies, ensuring they are understandable and accessible to all. In every article on FinCrypto, we strive to provide content that not only educates, but also empowers our readers, facilitating their integration into the financial digital age.

Click to comment

Fintech

Lloyds and Nationwide invest in Scottish fintech AI Aveni

Published

6 months ago

29 July, 2024

FinCrypto Staff

Lloyds and Nationwide invest in Scottish AI fintech Aveni

Lloyds Banking Group and Nationwide have joined an £11m Series A funding round in Scottish artificial intelligence fintech Aveni.

The investment is led by Puma Private Equity with additional participation from Par Equity.

Aveni creates AI products specifically designed to streamline workflows in the financial services industry by analyzing documents and meetings across a range of operational functions, with a focus on financial advisory services and consumer compliance.

The cash injection will help fund the development of a new product, FinLLM, a large-scale language model created specifically for the financial sector in partnership with Lloyds and Nationwide.

Joseph Twigg, CEO of Aveni, explains: “The financial services industry doesn’t need AI models that can quote Shakespeare, it needs AI models that offer transparency, trust and, most importantly, fairness. The way to achieve this is to develop small, highly tuned language models, trained on financial services data, vetted by financial services experts for specific financial services use cases.

“FinLLM’s goal is to set a new standard for the controlled, responsible and ethical adoption of generative AI, outperforming all other generic models in our selected financial services use cases.”

Robin Scher, head of fintech investment at Lloyds Banking Group, says the development programme offers a “massive opportunity” for the financial services industry by streamlining operations and improving customer experience.

“We look forward to supporting Aveni’s growth as we invest in their vision of developing FinLLM together with partners. Our collaboration aims to establish Aveni as a forerunner in AI adoption in the industry, while maintaining a focus on responsible use and customer centricity,” he said.

Source

Fintech

Fairexpay: Risk consultancy White Matter Advisory acquires 90% stake in fintech Fairexpay

Published

6 months ago

29 July, 2024

FinCrypto Staff

Treasury Risk Consulting Firm White Matter Alert On Monday he announced the acquisition of a 90% stake in the fintech startup Fair payment for an undisclosed amount. The acquisition will help White Matter Advisory expand its portfolio in the area of cross-border remittance and fundraising services, a statement said. White Matter Advisory, which operates under the name SaveDesk (White Matter Advisory India Pvt Ltd), is engaged in the treasury risk advisory business. It oversees funds under management (FUM) totaling $8 billion, offering advisory services to a wide range of clients.

Improve your technology skills with high-value skills courses

College OfferCourseWebsite

IIT Delhi	Data Science and Machine Learning Certificate Program	Visit
Indian School of Economics	ISB Product Management	Visit
MIT xPRO	MIT Technology Leadership and Innovation	Visit

White Matter Advisory, based in Bangalore, helps companies navigate the complexities of treasury and risk management.

Fairexpay, authorised by the Reserve Bank of India (RBI) under Cohort 2 of the Liberalised Remittance Scheme (LRS) Regulatory Sandbox, boasts features such as best-in-class exchange rates, 24-hour processing times and full security compliance.

“With this acquisition, White Matter Advisory will leverage Fairexpay’s advanced technology platform and regulatory approvals to enhance its services to its clients,” the release reads.

The integration of Fairexpay’s capabilities should provide White Matter Advisory with a competitive advantage in the cross-border remittance and fundraising market, he added.

The release also states that by integrating Fairexpay’s advanced technology, White Matter Advisory aims to offer seamless and convenient cross-border payment solutions, providing customers with secure options for international money transfers.

Source

Fintech

Rakuten Delays FinTech Business Reorganization to 2025

Published

6 months ago

29 July, 2024

FinCrypto Staff

Rakuten (Japan:4755) has released an update.

Rakuten Group, Inc. and Rakuten Bank, Ltd. announced a delay in the reorganization of Rakuten’s FinTech Business, moving the target date from October 2024 to January 2025. The delay is to allow for a more comprehensive review, taking into account regulatory, shareholder interests and the group’s optimal structure for growth. There are no anticipated changes to Rakuten Bank’s reorganization objectives, structure or listing status outside of the revised timeline.

For more insights on JP:4755 stock, check out TipRanks Stock Analysis Page.

Source

Fintech

White Matter Advisory Acquires 90% Stake in Fintech Startup Fairexpay

Published

6 months ago

29 July, 2024

FinCrypto Staff

White Matter Advisory Acquires 90% Stake in Fintech Startup Fairexpay

You are reading Entrepreneur India, an international franchise of Entrepreneur Media.

White Matter Advisory, which operates under the name SaveDesk in India, has announced that it is acquiring a 90% stake in fintech startup Fairexpay for an undisclosed amount.

This strategic move aims to strengthen White Matter Advisory’s portfolio in cross-border remittance and fundraising services.

By integrating Fairexpay’s advanced technology, White Matter Advisory aims to offer seamless and convenient cross-border payment solutions, providing customers with secure options for international money transfers.

White Matter Advisory, known for its treasury risk advisory services, manages funds under management (FUM) totaling USD 8 billion.

Founded by Bhaskar Saravana, Saurabh Jain, Kranthi Reddy and Piuesh Daga, White Matter Advisory helps companies effectively manage the complexities of treasury and risk management.

The SaveDesk platform offering includes a SaaS-based FX market data platform with real-time feeds for over 100 currencies, bank cost optimization services, customized treasury risk management solutions, and compliance guidance for the Foreign Exchange Management Act (FEMA) and other trade regulations.

Fairexpay is a global aggregation platform offering competitive currency exchange rates from numerous exchange partners worldwide. Catering to both private and corporate customers, Fairexpay provides seamless money transfer solutions for education, travel and immigration, as well as simplifying cross-border payments via API and white-label solutions for businesses. Key features include competitive currency exchange rates, 24-hour processing times, extensive currency coverage of over 30 currencies in more than 200 countries, and secure, RBI-compliant transactions.

Source