Attacks/Breaches

2/7/2018
06:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

North Korean APT Group Employed Rare Zero-Day Attack

Recent Adobe Flash exploit discovered against South Korean targets likely purchased, not developed by the hacking group.

It's rare for nation-state hackers out of North Korea to employ zero-day attacks, so the recent Adobe Flash Player zero-day exploit discovered targeting South Korean individuals was a bit of a novelty. Even so, it wasn't the first time the hacking team had employed a zero-day attack.

The threat actor group known as ScarCruft (aka Group 123 and Reaper) in June 2016 was spotted by researchers at Kaspersky Lab dropping a zero-day attack exploiting another Flash flaw (CVE-2016-4171), which allowed remote code execution. 

That attack, which Kaspersky dubbed Operation Daybreak, began with targeted spearphishing emails that contained a malicious URL that served up the exploit to the victim's machine. According to Kaspersky Lab, the attack hit an Asian law enforcement agency; a Dubai restaurant; a US-based mobile advertising and monetization firm; one of the world's largest trading companies, based in Asia; and members of the International Association of Athletics Federation.

At the time, ScarCruft was a relatively new advanced persistent threat (APT) group that had kept a low profile. ScarCruft is mostly known for cyber espionage and some destructive attacks, and was spotted targeting key South Korean institutions during the presidential election there last year with malicious documents.

"Now we see them with this new attack, and I would say it's pretty surprising, the use of a zero day," says Costin Raiu, director of the global research and analysis team at Kaspersky Lab. "Flash zero-days are not that popular anymore."

The recent attack campaign against South Korean diplomatic targets appears to have concluded on January 31, according to Kaspersky's telemetry. That's the same day that South Korea's Computer Emergency Response Team (KrCERT/CC) first issued an advisory on the zero-day vulnerability in Flash Player ActiveX 28.0.0.137 and earlier versions. The bug (CVE-2018-4878) abused in the attacks is a use-after-free vulnerability that allows remote code execution, according to Adobe's advisory.

Researchers at Cisco Talos found that the attack came via a rigged Microsoft Excel document that, once opened, downloaded the ROKRAT, a popular remote administration tool (RAT) used by advanced cybercrime gangs.

Raiu believes the attack group most likely purchased the Flash exploit and didn't discover the vulnerability itself. "I don't believe they could develop a zero day by themselves. My suspicion is that more likely, they were able to purchase it," he says. "They have access to cryptocurrency, which allows them to purchase zero days on the dark market."

He and other researchers say ScarCruft is not part of the infamous and prolific Lazarus Group, which was behind the destructive Sony attack and WannaCry. A spinoff group of Lazarus that Kaspersky Lab calls Bluenoroff is believed to be behind the SWIFT banking attacks. "Lazarus Group has hundreds of different malware variants, and they are incredibly resourceful," he says. "These guys [ScarCruft] are high-school level. I'm surprised they were able to acquire a zero day."

Targeting South Korean diplomatic and military individuals traditionally has been the gang's main mission, notes Benjamin Read, manager of cyber-espionage analysis at FireEye, which named the hacker group Reaper. "This attack is consistent to what they have been doing," he says. The group also has destructive malware tools, he says, but "we have not seen them use" them.

McAfee senior analyst Ryan Sherstobitoff says he's watched North Korea's cyberattack strategy overall mature and evolve since the early days of its distributed denial-of-service (DDoS) attacks against South Korean and US targets as cover for cyber espionage and data theft. The so-called Dark Seoul (aka Operation Troy) attacks in 2013, for example posed as hacktivists knocking websites offline and wiping hard drives — while in the background quietly stealing military secrets about South Korea and the US.

"They [North Korea] are far more aggressive and frequent than both China and Russia, because North Korea doesn't have any political cares. They don't care if they upset or interrupt foreign policy," Sherstobitoff notes.

In addition to mixing up their attack tools to mask their identity, he says North Korean attack groups also have evolved their social media targeting. "They are able to speak in foreign languages to target their victims" now, he says.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Mozilla, Internet Society and Others Pressure Retailers to Demand Secure IoT Products
Curtis Franklin Jr., Senior Editor at Dark Reading,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7629
PUBLISHED: 2019-02-18
Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sending a long message to the client.
CVE-2019-8919
PUBLISHED: 2019-02-18
The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2019-8917
PUBLISHED: 2019-02-18
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may b...
CVE-2019-8908
PUBLISHED: 2019-02-18
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/g...
CVE-2019-8909
PUBLISHED: 2019-02-18
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verification code image.