20 lakh Indians under threat from N Korean hackers, might attack via phishing emails

India is among six nations that may see a large cyber attack on June 21 in the form of Covid-19 themed phishing campaign from North Korean state hackers.

The attacks are a part of the Lazarus Group's large-scale campaign targeting more than 50 lakh individuals and businesses, including small and large enterprises, across six countries: India, Singapore, South Korea, Japan the UK and the US, according to a ZDNet report on Friday.

"The North Korean hacker group is looking to gain financially from the campaign, where targeted email recipients will be asked to visit fraudulent websites and lured into revealing their personal and financial data," according to Singapore-headquartered cybersecurity vendor Cyfirma.

Lazarus' hackers claimed to have details of 11 lakh individual email IDs in Japan, another 20 lakh in India, and 180,000 business contacts in the UK.

The attack would include 8,000 organisations in Singapore where the business contacts highlighted in an email template were addressed to members of the Singapore Business Federation (SBF), said the report.

Introduced in 2001 by the Ministry of Trade and Industry, SBF is responsible for promoting Singapore businesses and currently represents 27,200 companies.

"The targeted Singapore businesses would reportedly receive phishing email messages -- written in Chinese -- from a spoofed Ministry of Manpower account, supposedly offering additional payouts for employees under the government's Covid-19 support packages".

According to Cyfirma's Founder and CEO Kumar Ritesh, they have notified government CERTs (Computer Emergency Response Team) in Singapore, Japan, South Korea, India, and the US, as well as the UK National Cyber Security Center.

All six agencies had acknowledged the alert and currently were investigating.

"In the past six months, we have also monitored hacker activities related to the COVID-19 pandemic, especially with regards to hoax, phishing, and scam campaigns," Ritesh was quoted as saying.

Lazarus group is controlled by the Reconnaissance General Bureau, North Korea's primary intelligence bureau.

The Lazarus Group's activities were widely reported after it was blamed for the 2014 cyber attack on Sony Pictures Entertainment and the 2017 WannaCry ransomware attack on countries including the US and Britain.

In September last year, a malware created to infiltrate Indian ATMs and steal customers card data was traced by Kaspersky security researchers to the Lazarus group.