Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/15/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

North Korea-Linked Cyberattacks Spread Out of Control: Report

New details on old cyberattacks originating from North Korea indicate several forms of malware unintentionally spread wider than authors intended.

New research points to the broader range and related collateral damage caused by North Korea-linked cyberattacks that spread out of control. Researchers believe two of these threats likely originated from North Korea; one of them was likely an external group attacking North Korea.

Analysts at AlienVault published details on multiple attacks after collecting evidence from the millions of malicious files it scans each day. All of these attacks are separate but share commonalities, including a link to the Democratic People's Republic of Korea (DPRK), and causing more harm than was likely intended.

"These are all quite different attacks," explains Chris Doman, AlienVault security researcher and threat engineer. "They're all part of a broader trend of accidental damage from North Korea."

In a blog post on the research, Doman digs into the details of all the attacks, explaining where and when they were discovered, their relation to the DPRK, and how they spread outside the author's control.

Rivts Virus

Rivts is a malware family created in 2009 and still regularly seen by AlienVault, Doman explains, noting that the new files seen today are not the result of new developments from the author but of new files being infected with the original malware.

This is a file-infecting worm that spreads across USB drives and hard drives, and attaches itself to files to continue moving, he says, adding that it was first detected in January 2011 on the Voice of Korea, the DPRK's international broadcasting service. Doman hypothesizes that Rivts leaked from this site and moved around DPRK systems for two years before escaping from the Voice of Korea.

Doman calls Rivts a "fairly boring" virus but notes an interesting detail: it initially checks for system files normally found on Windows XP but looks for two pieces of unusual software in the Windows System folder. Both are pieces of DPRK software built by the Korea Computer Center.

"It was interesting to find a piece of malware that looked for North Korean software," Doman points out. "We thought at first it was something attacking North Korean systems."

It's more likely Rivts was a prototype or learning project, as indicated by the word "test" in multiple places, he notes, observing that the virus also doesn't have a backdoor, as many attacks from North Korea do. While Rivts "doesn't rank highly" on the threat scale, Doman says, it serves as a reminder that once a worm is released, it continues to spread for a long time.

JML Virus

It's possible Rivts is a new version of an early file-infector called the JML virus, another homemade attack from North Korea, according to Doman. JML, which started on Visual C++5.0 and MASM 6.0, was reportedly created in 1997 as part of a student's university project and later became a North Korean military standard. Mutations of the virus have spread outside the DPRK ever since.

"It's not interesting in terms of damage … it's interesting in terms of how far it could go," says Doman of JML. "I think what happened is it was probably an accident, copied over from another system in North Korea."

He links JML and Rivts with "low confidence." Both originated in North Korea, include the word "test," and built with Visual Studio C++ 5.0, a compiler rarely seen today. However, he says technical details make it impossible to positively determine a sample of the JML virus.

Faedevour Worm

In January 2015 an independent researcher discovered the Korean Central News Agency (KCNA) was distributing a form of malware called Faedevour. Unlike Rivts and the Voice of Korea site, researchers at Kaspersky report this was an intentional compromise by an outside attacker.

Analysis by Kaspersky indicates the DarkHotel group is responsible. Faedevour, like Rivts, is a worm and contains references to DPRK software it seeks on systems, explains Doman. It copies itself across to infect network shares and USB disks. While there is a possibility both were created by DarkHotel, Doman says this "does not seem to be the most likely explanation."

Doman says Faedevour accidentally spread in a supply chain compromise in April 2017. IBM and Lenovo had both sent storage server customers USB sticks containing installation software. Later on, he says, they learned the USB sticks had been infected with the Faedevour worm. Specifically, it was infected with the same exact malware file spotted on the KCNA website.

According to Doman, it's more likely this was an accidental infection than an intentional attack by DarkHotel, which would not likely use malware that had been created, and reported on, years earlier.

WannaCry and the Brambul Malware

Doman notes WannaCry, the attack that was created by Lazarus Group and spread via SMB file-shares, shares some of the same code base as the Brambul malware variant also released by Lazarus Group over the years. He says earlier forms of WannaCry do the same brute-forcing as Brambul and, to an extent, the massive attack could be described as a variant of Brambul.

"There are so many Brambul worms bouncing around the Internet," says Doman, that WannaCry is another instance in which the attacker lost control. "I would be surprised if the guys who wrote WannaCry expected to cause this much damage around the world. They created this thing that didn’t make much money but caused a lot of damage … if I was going to try and make a lot of money, I probably wouldn't draw too much attention to myself."

Related Content:

 

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
Anatomy of a BEC Scam
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15593
PUBLISHED: 2019-11-22
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
CVE-2019-16285
PUBLISHED: 2019-11-22
If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local drive.
CVE-2019-16286
PUBLISHED: 2019-11-22
An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a separate process that in turn can execute arbitrary commands.
CVE-2019-16287
PUBLISHED: 2019-11-22
An attacker may be able to leverage the application filter bypass vulnerability to gain privileged access to create a file on the local file system whose presence puts the device in Administrative Mode, which will allow the attacker to executed commands with elevated privileges.
CVE-2019-18909
PUBLISHED: 2019-11-22
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.