Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/24/2013
09:48 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

South Korean Universities Targeted By Chinese-Speaking Hackers

'PinkStats' malware has been used for hacking nation-state targets for four years

A newly discovered attack tool used by multiple groups of Chinese-speaking attackers has infected more than 1,000 machines in South Korea -- mainly universities and other academic institutions.

The so-called PinkStats malware family has been in use over the past four years, targeting various nation-states and organizations around the globe, according to Aviv Raff, CTO at Seculert, which studied the malware and posted its findings today.

"This is the first proof that there are Chinese-speaking attackers targeting [South Korea] entities," says Raff, who stopped short at confirming the attackers were from China. Even so, he says it's likely that they are Chinese: "These type of custom-made tools are usually created by the people speaking the language used in the tool, [such as where] Mahdi used Farsi strings," he says.

There's no evidence, either, to confirm that PinkStats was also used in the attacks earlier this year on South Korean banks, media networks, and an ISP that wiped hard drives and attached drives of infected machines. They also crippled targeted organizations for hours, and the machines weren't able to reboot. There was speculation of a North Korea or China connection to the attacks.

[Researchers confirm data-destroying malware that hit South Korean media and banks doesn't completely erase data. See Data Can Be Recovered From South Korea Data-Wiping Attacks. ]

PinkStats is a Trojan downloader that can install additional malware components. It camouflages itself by posing as a Web statistics or counter service in its communications to the command-and-control server and in the attacker's administrative panel login window.

In the South Korean attack, PinkStats also downloaded a typical Chinese hacking tool called zxarps that acts as a worm to spread in the victim's local network, via address resolution protocol (ARP) poisoning. The malicious iFrame it injects includes an ActiveX file digitally signed by Thwate. Seculert says the signature was valid as of May 8 and uses "Microsoft Corporation" as the product name and "Liaocheng YuanEr Technology CO., ltd.," as the publisher name -- a phony South Korean company.

PinkStats also installs a DDoS malware tool that goes by "Win8.exe" and poses as South Korean antivirus company AhnLab's V3 Light Framework software. "Up until now, the adversary did not seem to send any specific instructions to the installed DDoS malware. However, with the recent incidents of DDoS attacks against South Korean infrastructure, it is reasonable to assume that this state could change anytime soon," Seculert said in its blog post.

Seculert's Raff says the attackers were trying to amass as much computing power as possible from the South Korean universities. They deployed an additional worm tool that spreads the PinkStats malware within the local university network," he says, probably in order to use the machines for DDoS attacks.

Raff says his firm discovered the PinkStats malware while analyzing one of its customer's logs. That analysis led to Seculert finding evidence of the South Korean attacks. What makes PinkStats unique is that it's a downloader posing as a legitimate Web statistics service. "So even if someone will try to investigate the URL of the malware communication and [get] to the login page, he will see a page saying that is a login for 'statistics administration,'" he says.

Other attacks using PinkStats have downloaded information-stealing Trojans as well, he says.

"It really depends on the group using this tool, and the intent of their current operation and phase," Raff says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/11/2021
Edge-DRsplash-10-edge-articles
Cybersecurity: What Is Truly Essential?
Joshua Goldfarb, Director of Product Management at F5,  5/12/2021
Commentary
3 Cybersecurity Myths to Bust
Etay Maor, Sr. Director Security Strategy at Cato Networks,  5/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google Maps is taking "interactive" to a whole new level!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22117
PUBLISHED: 2021-05-18
RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.
CVE-2021-3518
PUBLISHED: 2021-05-18
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
CVE-2021-3531
PUBLISHED: 2021-05-18
A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.
CVE-2002-2438
PUBLISHED: 2021-05-18
TCP firewalls could be circumvented by sending a SYN Packets with other flags (like e.g. RST flag) set, which was not correctly discarded by the Linux TCP stack after firewalling.
CVE-2020-25709
PUBLISHED: 2021-05-18
A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.