Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/8/2018
07:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

North Korea Threat Group Targeting Turkish Financial Orgs

Hidden Cobra appears to be collecting information for a later strike, McAfee says.

Hidden Cobra, a threat group that the US government previously has linked to North Korea, appears to have turned its sights on financial institutions in Turkey.

Security vendor McAfee Thursday reported finding malware associated with the group surfacing on systems belonging to three large financial organizations and at least two major government-controlled entities involved in finance and trade in Turkey.

The malware, dubbed Bankshot, was last seen in 2017 and is designed to persist on compromised systems for further exploits. Its presence on the systems in Turkey suggests the Hidden Cobra operation is intended to gather specific information that can be used to launch more damaging attacks later, McAfee said.

"While we can't definitively establish motivations, it's likely these attacks are part of an ongoing effort on the part of the attackers to compromise major financial institutions," says Ryan Sherstobitoff, McAfee's senior analyst of major campaigns. The goal could be to "surveil their operations, establish functions of their processes, and ultimately compromise funds," he says.

Hidden Cobra, also referred to as the Lazarus Group and Guardians of Peace, is believed responsible for the attacks on the SWIFT financial network in 2016 that resulted in over $80 million being looted from the Bangladesh Bank. It has also been linked to numerous other attacks on media, aerospace, and critical infrastructure organizations in recent years.

The FBI and the US Department of Homeland Security have described the group as being sponsored by the North Korean government and having a wide array of attack tools at its disposal, including distributed denial-of-service botnets, wiper malware, and remote access Trojans. Tools associated with the group include Destover, a wiper malware used in the 2014 attacks on Sony Pictures, and Hangman, a malware used in targeted attacks.

Bankshot, the group's tool of choice in the Turkey campaign, was previously used in a major Korean bank attack and has been seen on documents purportedly from banks in Latin America.

McAfee's investigation shows that the Bankshot implants that Hidden Cobra is using in its campaign against Turkish financial institutions were distributed via sophisticated phishing emails. The emails have contained a malicious Word document with an embedded exploit for a recently disclosed Adobe Flash vulnerability.

The exploit basically allows an attacker to execute arbitrary code — Bankshot, in this case — on compromised systems. Available telemetry shows that that first infections in Turkey happened around March 2 and March 3, McAfee said.

Sherstobitoff says this is the first time McAfee has observed Hidden Cobra deploying Bankshot in Turkey. It is also the first time that McAfee has seen an entire country's financial system being targeted so systematically.

"Bankshot is a fully capable implant which grants attackers full capability on a victim's system. It is possible the attackers are in an early data-gathering stage for future heists," he says. In addition to stealing data, Bankshot also has a function to wipe files that can be remotely executed to erase evidence he says.

North Korea threat actors have been linked to a recent string of attacks — including numerous cryptocurrency mining campaigns and ransomware campaigns such as WannaCry. Many believe the campaigns are state sponsored and are likely designed to raise money for a government under increasing economic pressure from sanctions.

There are some, though, who believe that at least some of the attacks have involved false-flag campaigns. The most notable example is an attack on networks and servers during the opening of the Winter Olympics in South Korea that originally appeared to be the handiwork of North Korea but which many believe actually originated in Russia.

According to Sherstobitoff, however, there appears to be little doubt about who is behind the campaign in Turkey. "McAfee takes attribution very seriously. As such, McAfee Advanced Threat Research analysis and conclusions are based on multiple indicators," he says.

While 100% attribution is always going to be hard, the code and target similarities between the malicious files uncovered in this campaign and earlier attacks publicly attributed to Hidden Cobra are strong indicators of North Korean involvement, he says.

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.