CTI_Advisory_Undetected_North_Korean_Malware_A_Looming_Threat_to_Finan.pdf (926 KB)

Bridewell Intelligence warns that TA444, a financially motivated North Korea state-sponsored actor, poses a continuing threat to banks, financial institutions, and cryptocurrency exchanges. Pivoting from Proofpoint and Kaspersky reporting, Bridewell identified additional TA444 command-and-control infrastructure whose malware was largely undetected by conventional antivirus services, including several IPs with zero or very low VirusTotal detections. The advisory says TA444 has targeted banks for years and expanded further into cryptocurrency in late 2022, using tactics such as Porkbun DNS and Cloudflare services to obscure infrastructure. Financial-sector defenders are urged to retrospectively hunt for connections to the published indicators, add them to alerting or block lists, and pair threat intelligence with segmentation, advanced detection, audits, access controls, training, and incident-response planning.