Attacks/Breaches
7/9/2013
02:15 PM
50%
50%

South Korean Bank Hackers Target U.S. Military Secrets

Wiper malware APT gang has been traced to four-year military espionage campaign.

What of the WhoIs Team, which also claimed credit for the March wiper attacks? McAfee said that a wiper file traced to that group shared similarities with wiper malware used in New Romantic Cyber Army Team attacks. Still, it's unclear if the WhoIs Team is simply the same group, or another gang using repurposed malware components.

Overall, McAfee said it has tied New Romantic Cyber Army Team to Operation Troy attacks that occurred from 2009 to 2013. Malware used by the group, for example, appeared to have been employed in the 2011 "Ten Days of Rain" DDoS attacks against 40 sites affiliated with South Korean government, including U.S. Forces Korea and the U.S. Air Force Base in Kunsan, South Korea, as well as in other attacks that occurred in 2010, 2011 and 2013.

On June 25, meanwhile, the same group launched an attack against South Korean government and news websites, in part by distributing a modified installation file for the SimDisk file-sharing and storage service. That malware was distributed via the official SimDisk website, which pushes automatic updates to client software. Attackers hacked into the site and made it push not just a copy of the legitimate software, SimDisk.exe, to users, but also a disguised Trojan downloader, SimDiskup.exe.

That downloader connected to the Tor network to obtain a Trojan application called Castov that included a JPEG file that "contains a timestamp used by Castov to synchronize attacks," said a Symantec Security Response blog post. That timestamp detailed when all Castov-infected clients should send DNS requests to a South Korean government website, thus creating a DDoS attack.

Is the New Romantic Cyber Army Team simply a front for hackers in the employ of Pyongyang? According to South Korean cybersecurity experts, the March 2013 wiper attacks were traced to an IP address in the North Korean capital, which was revealed after the attacker experienced a technical glitch.

But the Troy-wielding gang has often launched their attacks under the hacktivism banner -- and the March wiper attacks, which included stealing data and holding it ransom, would appear to fit that mold. But McAfee's Sherstobitoff said that's likely just a ruse. "The Dark Seoul adversaries show a consistent pattern of psychological warfare that includes throwing off investigators by blaming the attacks on hacktivism," he said. "Both the March and June events share this feature."

Regardless of nomenclature, the attackers appear to have a grudge against both South Korea and the United States. For example, the date of the most recent attacks, June 25, was the 63rd anniversary of the start of the Korean War. "Conducting DDoS attacks and hard disk wiping on key historical dates is not new for the Dark Seoul gang," said Symantec. "They previously conducted DDoS and wiping attacks on the U.S. Independence Day as well."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7266
Published: 2015-02-01
Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service (CPU consumption) via vectors that trigger colliding hash-table keys. NOTE: this vulnerability exists because of an incomplete fix for CVE-2...

CVE-2014-7269
Published: 2015-02-01
ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earlier, and RT-N56U routers with firmware 3.0.0.4.376....

CVE-2014-7270
Published: 2015-02-01
Cross-site request forgery (CSRF) vulnerability on ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earl...

CVE-2014-8630
Published: 2015-02-01
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shel...

CVE-2014-9200
Published: 2015-02-01
Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X8...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.