An analysis of 80 devices believed to be linked to North Korea found that 22 devices, or 27.5% of the total, contained records related to services in Japan. The credential dumps did not contain the IDs or passwords themselves.
ZERO SECURITY reportedly analysed data from 80 devices believed to have strong links to North Korea and extracted URLs for stored credentials associated with Japanese recruitment and freelance, business collaboration and hosting services. The URL analysis reportedly found records for 52 domains related to services in Japan on 22 devices.
The findings suggest that Japanese companies need to expand the scope of their cybersecurity checks beyond internal systems to include points of contact involving recruitment and outsourced operations. The article points to the risk of compromise through contact with workers and contractors using false identities, as well as concerns about information leaks resulting from the misuse of legitimate privileges.
It also reports that the impact could extend beyond email accounts to source-code management, cloud environments, internal documents and customer information, making it important to monitor recruitment and outsourcing management as well as external exposure. It also describes measures combining dark-web monitoring, specialist investigations and ongoing monitoring of registered domains.