Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/15/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

North Korea-Linked Cyberattacks Spread Out of Control: Report

New details on old cyberattacks originating from North Korea indicate several forms of malware unintentionally spread wider than authors intended.

New research points to the broader range and related collateral damage caused by North Korea-linked cyberattacks that spread out of control. Researchers believe two of these threats likely originated from North Korea; one of them was likely an external group attacking North Korea.

Analysts at AlienVault published details on multiple attacks after collecting evidence from the millions of malicious files it scans each day. All of these attacks are separate but share commonalities, including a link to the Democratic People's Republic of Korea (DPRK), and causing more harm than was likely intended.

"These are all quite different attacks," explains Chris Doman, AlienVault security researcher and threat engineer. "They're all part of a broader trend of accidental damage from North Korea."

In a blog post on the research, Doman digs into the details of all the attacks, explaining where and when they were discovered, their relation to the DPRK, and how they spread outside the author's control.

Rivts Virus

Rivts is a malware family created in 2009 and still regularly seen by AlienVault, Doman explains, noting that the new files seen today are not the result of new developments from the author but of new files being infected with the original malware.

This is a file-infecting worm that spreads across USB drives and hard drives, and attaches itself to files to continue moving, he says, adding that it was first detected in January 2011 on the Voice of Korea, the DPRK's international broadcasting service. Doman hypothesizes that Rivts leaked from this site and moved around DPRK systems for two years before escaping from the Voice of Korea.

Doman calls Rivts a "fairly boring" virus but notes an interesting detail: it initially checks for system files normally found on Windows XP but looks for two pieces of unusual software in the Windows System folder. Both are pieces of DPRK software built by the Korea Computer Center.

"It was interesting to find a piece of malware that looked for North Korean software," Doman points out. "We thought at first it was something attacking North Korean systems."

It's more likely Rivts was a prototype or learning project, as indicated by the word "test" in multiple places, he notes, observing that the virus also doesn't have a backdoor, as many attacks from North Korea do. While Rivts "doesn't rank highly" on the threat scale, Doman says, it serves as a reminder that once a worm is released, it continues to spread for a long time.

JML Virus

It's possible Rivts is a new version of an early file-infector called the JML virus, another homemade attack from North Korea, according to Doman. JML, which started on Visual C++5.0 and MASM 6.0, was reportedly created in 1997 as part of a student's university project and later became a North Korean military standard. Mutations of the virus have spread outside the DPRK ever since.

"It's not interesting in terms of damage … it's interesting in terms of how far it could go," says Doman of JML. "I think what happened is it was probably an accident, copied over from another system in North Korea."

He links JML and Rivts with "low confidence." Both originated in North Korea, include the word "test," and built with Visual Studio C++ 5.0, a compiler rarely seen today. However, he says technical details make it impossible to positively determine a sample of the JML virus.

Faedevour Worm

In January 2015 an independent researcher discovered the Korean Central News Agency (KCNA) was distributing a form of malware called Faedevour. Unlike Rivts and the Voice of Korea site, researchers at Kaspersky report this was an intentional compromise by an outside attacker.

Analysis by Kaspersky indicates the DarkHotel group is responsible. Faedevour, like Rivts, is a worm and contains references to DPRK software it seeks on systems, explains Doman. It copies itself across to infect network shares and USB disks. While there is a possibility both were created by DarkHotel, Doman says this "does not seem to be the most likely explanation."

Doman says Faedevour accidentally spread in a supply chain compromise in April 2017. IBM and Lenovo had both sent storage server customers USB sticks containing installation software. Later on, he says, they learned the USB sticks had been infected with the Faedevour worm. Specifically, it was infected with the same exact malware file spotted on the KCNA website.

According to Doman, it's more likely this was an accidental infection than an intentional attack by DarkHotel, which would not likely use malware that had been created, and reported on, years earlier.

WannaCry and the Brambul Malware

Doman notes WannaCry, the attack that was created by Lazarus Group and spread via SMB file-shares, shares some of the same code base as the Brambul malware variant also released by Lazarus Group over the years. He says earlier forms of WannaCry do the same brute-forcing as Brambul and, to an extent, the massive attack could be described as a variant of Brambul.

"There are so many Brambul worms bouncing around the Internet," says Doman, that WannaCry is another instance in which the attacker lost control. "I would be surprised if the guys who wrote WannaCry expected to cause this much damage around the world. They created this thing that didn’t make much money but caused a lot of damage … if I was going to try and make a lot of money, I probably wouldn't draw too much attention to myself."

Related Content:

 

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9308
PUBLISHED: 2020-02-20
archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.
CVE-2019-20479
PUBLISHED: 2020-02-20
A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.
CVE-2011-2498
PUBLISHED: 2020-02-20
The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consumption) by triggering creation of PTE pages.
CVE-2012-2629
PUBLISHED: 2020-02-20
Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator account via an addnew action to admin/administrators_add.php; or (2) c...
CVE-2014-3484
PUBLISHED: 2020-02-20
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid ...