Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/7/2018
06:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

North Korean APT Group Employed Rare Zero-Day Attack

Recent Adobe Flash exploit discovered against South Korean targets likely purchased, not developed by the hacking group.

It's rare for nation-state hackers out of North Korea to employ zero-day attacks, so the recent Adobe Flash Player zero-day exploit discovered targeting South Korean individuals was a bit of a novelty. Even so, it wasn't the first time the hacking team had employed a zero-day attack.

The threat actor group known as ScarCruft (aka Group 123 and Reaper) in June 2016 was spotted by researchers at Kaspersky Lab dropping a zero-day attack exploiting another Flash flaw (CVE-2016-4171), which allowed remote code execution. 

That attack, which Kaspersky dubbed Operation Daybreak, began with targeted spearphishing emails that contained a malicious URL that served up the exploit to the victim's machine. According to Kaspersky Lab, the attack hit an Asian law enforcement agency; a Dubai restaurant; a US-based mobile advertising and monetization firm; one of the world's largest trading companies, based in Asia; and members of the International Association of Athletics Federation.

At the time, ScarCruft was a relatively new advanced persistent threat (APT) group that had kept a low profile. ScarCruft is mostly known for cyber espionage and some destructive attacks, and was spotted targeting key South Korean institutions during the presidential election there last year with malicious documents.

"Now we see them with this new attack, and I would say it's pretty surprising, the use of a zero day," says Costin Raiu, director of the global research and analysis team at Kaspersky Lab. "Flash zero-days are not that popular anymore."

The recent attack campaign against South Korean diplomatic targets appears to have concluded on January 31, according to Kaspersky's telemetry. That's the same day that South Korea's Computer Emergency Response Team (KrCERT/CC) first issued an advisory on the zero-day vulnerability in Flash Player ActiveX 28.0.0.137 and earlier versions. The bug (CVE-2018-4878) abused in the attacks is a use-after-free vulnerability that allows remote code execution, according to Adobe's advisory.

Researchers at Cisco Talos found that the attack came via a rigged Microsoft Excel document that, once opened, downloaded the ROKRAT, a popular remote administration tool (RAT) used by advanced cybercrime gangs.

Raiu believes the attack group most likely purchased the Flash exploit and didn't discover the vulnerability itself. "I don't believe they could develop a zero day by themselves. My suspicion is that more likely, they were able to purchase it," he says. "They have access to cryptocurrency, which allows them to purchase zero days on the dark market."

He and other researchers say ScarCruft is not part of the infamous and prolific Lazarus Group, which was behind the destructive Sony attack and WannaCry. A spinoff group of Lazarus that Kaspersky Lab calls Bluenoroff is believed to be behind the SWIFT banking attacks. "Lazarus Group has hundreds of different malware variants, and they are incredibly resourceful," he says. "These guys [ScarCruft] are high-school level. I'm surprised they were able to acquire a zero day."

Targeting South Korean diplomatic and military individuals traditionally has been the gang's main mission, notes Benjamin Read, manager of cyber-espionage analysis at FireEye, which named the hacker group Reaper. "This attack is consistent to what they have been doing," he says. The group also has destructive malware tools, he says, but "we have not seen them use" them.

McAfee senior analyst Ryan Sherstobitoff says he's watched North Korea's cyberattack strategy overall mature and evolve since the early days of its distributed denial-of-service (DDoS) attacks against South Korean and US targets as cover for cyber espionage and data theft. The so-called Dark Seoul (aka Operation Troy) attacks in 2013, for example posed as hacktivists knocking websites offline and wiping hard drives — while in the background quietly stealing military secrets about South Korea and the US.

"They [North Korea] are far more aggressive and frequent than both China and Russia, because North Korea doesn't have any political cares. They don't care if they upset or interrupt foreign policy," Sherstobitoff notes.

In addition to mixing up their attack tools to mask their identity, he says North Korean attack groups also have evolved their social media targeting. "They are able to speak in foreign languages to target their victims" now, he says.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1874
PUBLISHED: 2019-06-20
A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the web-ba...
CVE-2019-1875
PUBLISHED: 2019-06-20
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by t...
CVE-2019-1876
PUBLISHED: 2019-06-20
A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exp...
CVE-2019-1878
PUBLISHED: 2019-06-20
A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insuff...
CVE-2019-1879
PUBLISHED: 2019-06-20
A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could exploi...