North Korea-linked hack hits largely invisible software that powers online services

SEOUL – Hackers linked to North Korea breached behind-the-scenes software that runs many common online functions in an effort to steal login information that could enable further cyberoperations, Google said on March 31.

The hackers targeted Axios, a programme that connects apps and web services, by adding their own malicious software to an update issued on March 30, Google and independent cyberresearchers said after the hack came to light early on March 31.

“Every time you load a website, check your bank balance, or open an app on your phone, there’s a good chance Axios is running somewhere in the background making that work,” said Mr Tom Hegel, a senior researcher at SentinelOne.

The malicious software, which has since been removed, could have given hackers access to a computer’s data including access credentials, which can then be used to carry out additional data theft or other kinds of attacks.

The developers of Axios could not immediately be reached for comment. Rather than a proprietary commercial product, the software is open source, meaning the code can be openly licensed and modified by users.

The cyberresearchers described the breach as a supply chain attack, in which the hack could enable attacks on downstream entities.

“You don’t have to click anything or make a mistake,” Mr Hegel said. “The software you already trust did it for you.”

Google attributed the hack to a group it tracks as UNC1069. It said in a February report that the group has operated since at least 2018 and is known for targeting the cryptocurrency and financial industries.

“North Korean hackers have deep experience with supply chain attacks, which they primarily use to steal cryptocurrency,” Mr John Hultquist, chief analyst for Google’s threat intelligence group, said in a statement.

North Korea uses stolen crypto to fund its weapons and other programmes, and evade sanctions, according to the US government.

North Korea’s mission to the UN did not immediately respond to a request for comment.

The hackers created versions of the malware that could infect macOS, Windows and Linux operating systems, according to an analysis published by cybersecurity firm Elastic Security.

The hackers’ methods meant “the attacker gained a delivery mechanism with potential reach into millions of environments”, Elastic said. It was not clear how many times the malicious software was downloaded.

Efforts to contact the hackers were unsuccessful. REUTERS