Anyway, the group, that is believed to be linked to the notorious Lazarus APT group, is continuing to target organizations in Europe and East Asia.
The group has been around at least since 2017 and is still active, the APT has targeted civilian electric energy organizations to steal intellectual property and gather intelligence on industrial operations.
Differently, from other threat actors that are focused on industrial control systems, Covellite seems to be not interested in sabotage.
In September 2017, experts from FireEye spotted a wave of attacks launched by the APT group against U.S. electric companies, the phishing messages used weaponized Word documents to deliver a piece of malware.
“COVELLITE compromises networks associated with civilian electric energy worldwide and gathers intelligence on intellectual property and internal industrial operations. COVELLITE lacks an industrial control system (ICS) specific capability at this time.” reads the post published by Dragos.
“COVELLITE operates globally with targets primarily in Europe, East Asia, and North America. US targets emerged in September 2017 with a small, targeted phishing campaign directed at select U.S. electric companies.”
The experts linked the attacks to Pyongyang and confirmed that the group did not show the ability to disrupt power supply.
“technical analysis of COVELLITE malware indicates an evolution from known LAZARUS toolkits. However, aside from technical overlap, it is not known how the capabilities and operations between COVELLITE and LAZARUS are related.” continues the post.
“Given the group’s specific interest in infrastructure operations, rapidly improving capabilities, and history of aggressive targeting, Dragos considers this group a primary threat to the ICS industry,”
(Security Affairs – APT group, cyber espionage)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.