Kaspersky detects compromised servers in India controlled by cybercrime group Lazarus

IT security software maker Kaspersky has detected some servers in India that were used by notorious cybercriminal gang Lazarus which is believed to be behind large-scale cyber-attacks across the world including recent **WannaCry** ransomware. [caption id=“attachment_3966661” align=“alignleft” width=“380”]  Representative Image[/caption] While researching the latest activities of the infamous cybercriminal group Lazarus, Kaspersky Lab has uncovered a number of compromised servers being used as part of the threat actor’s global command and control infrastructure, the software company said. “The compromised servers, found in Indonesia, India, Bangladesh, Malaysia, Vietnam, South Korea, Taiwan, and Thailand, among others, could be used by Lazarus to launch targeted attacks against a company or organisation,” Kaspersky Lab said in a statement. Korean speaking Lazarus group is believed to be behind recent high profile cyber attacks like the 2014 hack of Sony Pictures, the million-dollar Bangladesh Bank heist in 2016, and the recent WannaCry destructive ransomware epidemic, as per the statement. The criminal group by name of Guardians of Peace had claimed responsibility on Sony Pictures. It had demanded Sony to pull down film ‘The Interview’ which was a comedy about a plot to assassinate North Korean leader Kim Jong-un. Kaspersky said that Lazarus which is also Korean speaking group “is thought to be state-sponsored”. The US, China and India are top three countries housing maximum number of compromised servers, the Kaspersky Lab report said. “According to open source intelligence, three of the top five countries that still have servers carrying this vulnerability is in the APAC region: China (with 7,848), India (1,524), and Hong Kong (1,102). The US tops the list with the most vulnerable servers (11,949), while the United Kingdom ranks 5th with 805,” the report said. Kaspersky Lab said that researchers have discovered that the servers had been infected using malware called Manuscrypt, which could have been installed using a vulnerability in Microsoft Internet Information Services that was patched by Microsoft on 13 June 2017.