Attacks/Breaches

2/7/2018
06:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

North Korean APT Group Employed Rare Zero-Day Attack

Recent Adobe Flash exploit discovered against South Korean targets likely purchased, not developed by the hacking group.

It's rare for nation-state hackers out of North Korea to employ zero-day attacks, so the recent Adobe Flash Player zero-day exploit discovered targeting South Korean individuals was a bit of a novelty. Even so, it wasn't the first time the hacking team had employed a zero-day attack.

The threat actor group known as ScarCruft (aka Group 123 and Reaper) in June 2016 was spotted by researchers at Kaspersky Lab dropping a zero-day attack exploiting another Flash flaw (CVE-2016-4171), which allowed remote code execution. 

That attack, which Kaspersky dubbed Operation Daybreak, began with targeted spearphishing emails that contained a malicious URL that served up the exploit to the victim's machine. According to Kaspersky Lab, the attack hit an Asian law enforcement agency; a Dubai restaurant; a US-based mobile advertising and monetization firm; one of the world's largest trading companies, based in Asia; and members of the International Association of Athletics Federation.

At the time, ScarCruft was a relatively new advanced persistent threat (APT) group that had kept a low profile. ScarCruft is mostly known for cyber espionage and some destructive attacks, and was spotted targeting key South Korean institutions during the presidential election there last year with malicious documents.

"Now we see them with this new attack, and I would say it's pretty surprising, the use of a zero day," says Costin Raiu, director of the global research and analysis team at Kaspersky Lab. "Flash zero-days are not that popular anymore."

The recent attack campaign against South Korean diplomatic targets appears to have concluded on January 31, according to Kaspersky's telemetry. That's the same day that South Korea's Computer Emergency Response Team (KrCERT/CC) first issued an advisory on the zero-day vulnerability in Flash Player ActiveX 28.0.0.137 and earlier versions. The bug (CVE-2018-4878) abused in the attacks is a use-after-free vulnerability that allows remote code execution, according to Adobe's advisory.

Researchers at Cisco Talos found that the attack came via a rigged Microsoft Excel document that, once opened, downloaded the ROKRAT, a popular remote administration tool (RAT) used by advanced cybercrime gangs.

Raiu believes the attack group most likely purchased the Flash exploit and didn't discover the vulnerability itself. "I don't believe they could develop a zero day by themselves. My suspicion is that more likely, they were able to purchase it," he says. "They have access to cryptocurrency, which allows them to purchase zero days on the dark market."

He and other researchers say ScarCruft is not part of the infamous and prolific Lazarus Group, which was behind the destructive Sony attack and WannaCry. A spinoff group of Lazarus that Kaspersky Lab calls Bluenoroff is believed to be behind the SWIFT banking attacks. "Lazarus Group has hundreds of different malware variants, and they are incredibly resourceful," he says. "These guys [ScarCruft] are high-school level. I'm surprised they were able to acquire a zero day."

Targeting South Korean diplomatic and military individuals traditionally has been the gang's main mission, notes Benjamin Read, manager of cyber-espionage analysis at FireEye, which named the hacker group Reaper. "This attack is consistent to what they have been doing," he says. The group also has destructive malware tools, he says, but "we have not seen them use" them.

McAfee senior analyst Ryan Sherstobitoff says he's watched North Korea's cyberattack strategy overall mature and evolve since the early days of its distributed denial-of-service (DDoS) attacks against South Korean and US targets as cover for cyber espionage and data theft. The so-called Dark Seoul (aka Operation Troy) attacks in 2013, for example posed as hacktivists knocking websites offline and wiping hard drives — while in the background quietly stealing military secrets about South Korea and the US.

"They [North Korea] are far more aggressive and frequent than both China and Russia, because North Korea doesn't have any political cares. They don't care if they upset or interrupt foreign policy," Sherstobitoff notes.

In addition to mixing up their attack tools to mask their identity, he says North Korean attack groups also have evolved their social media targeting. "They are able to speak in foreign languages to target their victims" now, he says.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...