Attacks/Breaches
7/9/2013
02:15 PM
50%
50%

South Korean Bank Hackers Target U.S. Military Secrets

Wiper malware APT gang has been traced to four-year military espionage campaign.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
The wiper malware attack against South Korean banks and broadcasters in March 2013 has been traced to an advanced persistent threat (APT) gang that's been targeting South Korean and U.S. military secrets for at least four years.

The March attacks, which culminated in the master boot record of thousands of South Korean PCs being deleted by attackers, has been dubbed "Dark Seoul." But according to a new research report published by McAfee, Dark Seoul was just one of many attacks launched as part of a long-running campaign known as Operation Troy. That name was inspired by the frequency with which the word "Troy" features in the compile path strings of the group's malware.

"The prime suspect group in these attacks is the New Romantic Cyber Army Team, which makes frequent use of Roman and classical terms in their code," said McAfee's report. McAfee said that after identifying similarities between malware variants used in disparate attacks -- including 2011 distributed denial-of-service (DDoS) attacks -- it finally identified what appears to be the gang's raison d'être.

[ How deep does U.S. hacking go? Read Snowden Says U.S. Hacking Chinese Civilians Since 2009. ]

"The missing element was military espionage," said McAfee threat researcher Ryan Sherstobitoff in a blog post. "One of the primary goals of this group was a covert military spying operation that attempted to target military forces in South Korea," including U.S. Forces Korea.

New Romantic Cyber Army Team had already claimed credit for the March wiper malware attacks, saying it had erased 180,000 South Korean PCs, in contrast to official South Korean government estimates, which said that about 32,000 PCs were affected. The hackers also boasted that prior to wiping the systems, they'd stolen information on 2.5 million members of an organization -- the name of which was blacked out by McAfee -- plus content management system information pertaining to 50 million people, as well as unspecified bank information.

McAfee said that the group's claims that it stole massive amounts of data from infected PCs appeared to be true, because in the weeks prior to the March mass wiping of master boot records, the attackers appeared to have already infected the systems and enjoyed unrestricted access. That would have allowed them ample time to mine PCs for interesting information.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.