The article from The Hacker News reports on North Korean threat actors exploiting vulnerabilities in ConnectWise ScreenConnect to deploy a new malware named TODDLERSHARK. This malware, which is linked to the known Kimsuky malware group and its variants like BabyShark and ReconShark, was used to gain access to a victim’s workstation. The attack exploited newly discovered vulnerabilities CVE-2024-1708 and CVE-2024-1709 in the ScreenConnect application. TODDLERSHARK is designed to capture and exfiltrate sensitive information, showcasing sophisticated evasion techniques. This incident is part of a broader trend of increasing cybersecurity threats in the banking sector.
