Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/25/2018
06:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Malware in South Korean Cyberattacks Linked to Bithumb Heist

Lazarus Group is likely behind a spearphishing campaign containing malicious code to download Manuscrypt malware.

Lazarus Group, a team of cybercriminals reportedly based in North Korea, is believed to be targeting its southern neighbor with malicious documents. The files, recently reviewed by South Korean researchers and experts at AlienVault, pack Manuscrypt malware as the final payload.

Researchers in South Korea first detected the documents. One is disguised as related to the G20 International Financial Architecture Working Group Meeting and appears to target attendees, who met to discuss economic policies among the world's financial superpowers. Another is seemingly related to the $31.5 million theft from the Bithumb cryptocurrency exchange.

All documents were created in Hangul Word Processor (HWP), a South Korean document editor, and contain malicious code to download Manuscrypt malware. Manuscrypt communicates by mimicking South Korean forum software, AlienVault researchers report.

Manuscrypt is referred to as "Bankshot" by McAfee, which uses the term "Hidden Cobra" for the organization known as Lazarus Group. The malware is designed to remain on a target network for continued exploitation and has been seen in attacks on the Turkish financial sector, which was hit with malicious documents written in Korean in March. Threat actors could use the malware to gain full access and wipe content from a target system, McAfee explains.

This isn't the first time researchers have linked Manuscrypt to Lazarus Group, which allegedly also used the malware in advanced persistent threat (APT) attacks targeting financial institutions and the SWIFT banking network. In the earlier campaign, Manuscrypt operated by searching the internal network for specific hosts related to SWIFT. The threat leveraged the NamedPipe file-sharing feature to search for data on the internal segregated network and send it to the command-and-control (C&C) server.

Link to Bithumb Cryptocurrency Theft
Researchers have suggested a connection between the most recent Lazarus Group activity and the theft of $31.5 million in digital currency from South Korean cryptocurrency exchange Bithumb. Reports within the country indicate the heist also began with HWP files this month and last month, and experts link the incident to earlier attacks by Lazarus Group.

South Korean news organization KBS reports an investigation into the Bithumb theft revealed malware samples that had been sent to other cryptocurrency organizations. AlienVault says "it seems likely" the malware used in this recent campaign is responsible for the Bithumb incident.

Earlier this year, researchers detected Lazarus Group sending malicious HWP documents to cryptocurrency users in South Korea. In these cases, multiple phishing domains were registered to the same phone number as a domain used to deliver the malware. It seems attackers could be phishing for credentials in addition to the malware, though experts say this activity is tricky.

"It is unusual to see Lazarus registering domains," AlienVault researchers wrote in a blog post on the discovery. "Normally they prefer to compromise legitimate websites. So this would be an unusual attack if it is indeed run by members of Lazarus."

Putting the Pieces Together
If Lazarus Group is behind the Bithumb attack, it ties these actors to a series of thefts, including $7 million previously stolen from Bithumb in 2017, as well as other cryptocurrency exchanges that were hit in 2017. The group is also believed to be responsible for the attempted theft of $1 billion from the Bank of Bangladesh, attacks on ATM networks, and the WannaCry and Sony Pictures incidents.

Earlier this month, reports indicated Lazarus Group was behind a theft of $10 million from a Chilean bank; it allegedly destroyed thousands of machines to try to conceal its activity. AlienVault notes that specifically targeting South Korean organizations doubly benefits North Korean adversaries because it has the "double impact of weakening their closest competitor."

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RDP Bug Takes New Approach to Host Compromise
Kelly Sheridan, Staff Editor, Dark Reading,  7/18/2019
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12162
PUBLISHED: 2019-07-23
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
CVE-2018-18669
PUBLISHED: 2019-07-23
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board title contents" parameter, aka the adm/board_form_update.php bo_subject parameter.
CVE-2019-10101
PUBLISHED: 2019-07-23
Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function Jsi_ValueArrayIndex (jsiValue.c:366). The attack vector is: executing crafted javascript code. The fixed version is: after commit 738ead193aff380a7e3d7ffb8e11e446f76867f3.
CVE-2019-9815
PUBLISHED: 2019-07-23
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thre...
CVE-2019-9816
PUBLISHED: 2019-07-23
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supp...