News for hackers. Stuff that matters.
Re:Active North Korean campaign targeting security researchers by beardedwizard on Thursday September 07, 2023 @01:58PM (#37422949)
It states clearly in the article the goal was to acquire debug symbols for Ms, Citrix, and others with the goal of reverse engineering. If you have been following Citrix, their Netscaler product has been the subject of multiple high severity vulnerabilities, and they sit in mission critical networks. From here the most likely move is their most common, ransomware, the proceeds from which they use to fund parts of their military.
Re:Active North Korean campaign targeting security researchers by testplzignore on Thursday September 07, 2023 @02:21PM (#37423323)
That was the stated legitimate purpose of the GetSymbol software by its creators. As far as I understand, this data is freely available and the GetSymbol software makes it easier to download rather than having to go to multiple different websites.

The ultimate purpose of the malware embedded within the GetSymbol software is what is not known.

Re:Active North Korean campaign targeting security researchers by operator-name on Thursday September 07, 2023 @02:21PM (#37423326)
That was the decoy behind the secondary infection vector, not the motivation.
Re:Active North Korean campaign targeting security researchers by beardedwizard on Friday September 08, 2023 @02:16PM (#37437284)
I'm skeptical given the ms attack involved stealing keys from core dumps