ZINC

Zinc, also known as Diamond Sleet, is a North Korea-based threat actor group that has been active since 2009. This group is notorious for its cyber-attacks aimed at collecting political, military, and economic intelligence on North Korea's foreign adversaries, and executing currency generation campaigns. Microsoft's Threat Intelligence team has been tracking this group's activities, which have primarily targeted media, defense, and information technology (IT) industries globally. The group has also been linked to other North Korean Advanced Persistent Threat (APT) groups including Lazarus Group, Hidden Cobra, and Andariel. In 2022, Zinc reached a peak in its malicious activities. Notably, Microsoft Threat Intelligence uncovered a supply chain attack orchestrated by Zinc involving a trojanized variant of an application developed by CyberLink Corp., a software company known for multimedia software products. This marked a significant escalation in the group's tactics, weaponizing open-source software to compromise systems and networks. In October 2023, Zinc, along with several other North Korea-backed APTs, was implicated in exploiting the TeamCity vulnerability to install persistent backdoors into systems. Despite the increase in production of nickel and zinc in 2022, predominantly from Indonesia and China, the global prices for these commodities are expected to be suppressed. Meanwhile, Zinc continues to pose a significant cybersecurity threat. Microsoft's threat intelligence team attributes this ongoing campaign to Zinc, revealing the group's persistent efforts to exploit vulnerabilities and compromise systems. As of now, organizations, particularly those in the media, defense, and IT sectors, need to remain vigilant about this threat actor and continue to prioritize robust cybersecurity measures.