Attacks/Breaches
7/9/2013
02:15 PM
Connect Directly
RSS
E-Mail
50%
50%

South Korean Bank Hackers Target U.S. Military Secrets

Wiper malware APT gang has been traced to four-year military espionage campaign.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
The wiper malware attack against South Korean banks and broadcasters in March 2013 has been traced to an advanced persistent threat (APT) gang that's been targeting South Korean and U.S. military secrets for at least four years.

The March attacks, which culminated in the master boot record of thousands of South Korean PCs being deleted by attackers, has been dubbed "Dark Seoul." But according to a new research report published by McAfee, Dark Seoul was just one of many attacks launched as part of a long-running campaign known as Operation Troy. That name was inspired by the frequency with which the word "Troy" features in the compile path strings of the group's malware.

"The prime suspect group in these attacks is the New Romantic Cyber Army Team, which makes frequent use of Roman and classical terms in their code," said McAfee's report. McAfee said that after identifying similarities between malware variants used in disparate attacks -- including 2011 distributed denial-of-service (DDoS) attacks -- it finally identified what appears to be the gang's raison d'être.

[ How deep does U.S. hacking go? Read Snowden Says U.S. Hacking Chinese Civilians Since 2009. ]

"The missing element was military espionage," said McAfee threat researcher Ryan Sherstobitoff in a blog post. "One of the primary goals of this group was a covert military spying operation that attempted to target military forces in South Korea," including U.S. Forces Korea.

New Romantic Cyber Army Team had already claimed credit for the March wiper malware attacks, saying it had erased 180,000 South Korean PCs, in contrast to official South Korean government estimates, which said that about 32,000 PCs were affected. The hackers also boasted that prior to wiping the systems, they'd stolen information on 2.5 million members of an organization -- the name of which was blacked out by McAfee -- plus content management system information pertaining to 50 million people, as well as unspecified bank information.

McAfee said that the group's claims that it stole massive amounts of data from infected PCs appeared to be true, because in the weeks prior to the March mass wiping of master boot records, the attackers appeared to have already infected the systems and enjoyed unrestricted access. That would have allowed them ample time to mine PCs for interesting information.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio