Threat Intelligence

04:20 PM
Connect Directly

North Korea-Linked Cyberattacks Spread Out of Control: Report

New details on old cyberattacks originating from North Korea indicate several forms of malware unintentionally spread wider than authors intended.

New research points to the broader range and related collateral damage caused by North Korea-linked cyberattacks that spread out of control. Researchers believe two of these threats likely originated from North Korea; one of them was likely an external group attacking North Korea.

Analysts at AlienVault published details on multiple attacks after collecting evidence from the millions of malicious files it scans each day. All of these attacks are separate but share commonalities, including a link to the Democratic People's Republic of Korea (DPRK), and causing more harm than was likely intended.

"These are all quite different attacks," explains Chris Doman, AlienVault security researcher and threat engineer. "They're all part of a broader trend of accidental damage from North Korea."

In a blog post on the research, Doman digs into the details of all the attacks, explaining where and when they were discovered, their relation to the DPRK, and how they spread outside the author's control.

Rivts Virus

Rivts is a malware family created in 2009 and still regularly seen by AlienVault, Doman explains, noting that the new files seen today are not the result of new developments from the author but of new files being infected with the original malware.

This is a file-infecting worm that spreads across USB drives and hard drives, and attaches itself to files to continue moving, he says, adding that it was first detected in January 2011 on the Voice of Korea, the DPRK's international broadcasting service. Doman hypothesizes that Rivts leaked from this site and moved around DPRK systems for two years before escaping from the Voice of Korea.

Doman calls Rivts a "fairly boring" virus but notes an interesting detail: it initially checks for system files normally found on Windows XP but looks for two pieces of unusual software in the Windows System folder. Both are pieces of DPRK software built by the Korea Computer Center.

"It was interesting to find a piece of malware that looked for North Korean software," Doman points out. "We thought at first it was something attacking North Korean systems."

It's more likely Rivts was a prototype or learning project, as indicated by the word "test" in multiple places, he notes, observing that the virus also doesn't have a backdoor, as many attacks from North Korea do. While Rivts "doesn't rank highly" on the threat scale, Doman says, it serves as a reminder that once a worm is released, it continues to spread for a long time.

JML Virus

It's possible Rivts is a new version of an early file-infector called the JML virus, another homemade attack from North Korea, according to Doman. JML, which started on Visual C++5.0 and MASM 6.0, was reportedly created in 1997 as part of a student's university project and later became a North Korean military standard. Mutations of the virus have spread outside the DPRK ever since.

"It's not interesting in terms of damage … it's interesting in terms of how far it could go," says Doman of JML. "I think what happened is it was probably an accident, copied over from another system in North Korea."

He links JML and Rivts with "low confidence." Both originated in North Korea, include the word "test," and built with Visual Studio C++ 5.0, a compiler rarely seen today. However, he says technical details make it impossible to positively determine a sample of the JML virus.

Faedevour Worm

In January 2015 an independent researcher discovered the Korean Central News Agency (KCNA) was distributing a form of malware called Faedevour. Unlike Rivts and the Voice of Korea site, researchers at Kaspersky report this was an intentional compromise by an outside attacker.

Analysis by Kaspersky indicates the DarkHotel group is responsible. Faedevour, like Rivts, is a worm and contains references to DPRK software it seeks on systems, explains Doman. It copies itself across to infect network shares and USB disks. While there is a possibility both were created by DarkHotel, Doman says this "does not seem to be the most likely explanation."

Doman says Faedevour accidentally spread in a supply chain compromise in April 2017. IBM and Lenovo had both sent storage server customers USB sticks containing installation software. Later on, he says, they learned the USB sticks had been infected with the Faedevour worm. Specifically, it was infected with the same exact malware file spotted on the KCNA website.

According to Doman, it's more likely this was an accidental infection than an intentional attack by DarkHotel, which would not likely use malware that had been created, and reported on, years earlier.

WannaCry and the Brambul Malware

Doman notes WannaCry, the attack that was created by Lazarus Group and spread via SMB file-shares, shares some of the same code base as the Brambul malware variant also released by Lazarus Group over the years. He says earlier forms of WannaCry do the same brute-forcing as Brambul and, to an extent, the massive attack could be described as a variant of Brambul.

"There are so many Brambul worms bouncing around the Internet," says Doman, that WannaCry is another instance in which the attacker lost control. "I would be surprised if the guys who wrote WannaCry expected to cause this much damage around the world. They created this thing that didn’t make much money but caused a lot of damage … if I was going to try and make a lot of money, I probably wouldn't draw too much attention to myself."

Related Content:




Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
The Case for Integrating Physical Security & Cybersecurity
Paul Kurtz, CEO & Cofounder, TruSTAR Technology,  3/20/2018
Cybercriminals Launder Up to $200B in Profit Per Year
Kelly Sheridan, Staff Editor, Dark Reading,  3/19/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.