Threat Intelligence

2/15/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

North Korea-Linked Cyberattacks Spread Out of Control: Report

New details on old cyberattacks originating from North Korea indicate several forms of malware unintentionally spread wider than authors intended.

New research points to the broader range and related collateral damage caused by North Korea-linked cyberattacks that spread out of control. Researchers believe two of these threats likely originated from North Korea; one of them was likely an external group attacking North Korea.

Analysts at AlienVault published details on multiple attacks after collecting evidence from the millions of malicious files it scans each day. All of these attacks are separate but share commonalities, including a link to the Democratic People's Republic of Korea (DPRK), and causing more harm than was likely intended.

"These are all quite different attacks," explains Chris Doman, AlienVault security researcher and threat engineer. "They're all part of a broader trend of accidental damage from North Korea."

In a blog post on the research, Doman digs into the details of all the attacks, explaining where and when they were discovered, their relation to the DPRK, and how they spread outside the author's control.

Rivts Virus

Rivts is a malware family created in 2009 and still regularly seen by AlienVault, Doman explains, noting that the new files seen today are not the result of new developments from the author but of new files being infected with the original malware.

This is a file-infecting worm that spreads across USB drives and hard drives, and attaches itself to files to continue moving, he says, adding that it was first detected in January 2011 on the Voice of Korea, the DPRK's international broadcasting service. Doman hypothesizes that Rivts leaked from this site and moved around DPRK systems for two years before escaping from the Voice of Korea.

Doman calls Rivts a "fairly boring" virus but notes an interesting detail: it initially checks for system files normally found on Windows XP but looks for two pieces of unusual software in the Windows System folder. Both are pieces of DPRK software built by the Korea Computer Center.

"It was interesting to find a piece of malware that looked for North Korean software," Doman points out. "We thought at first it was something attacking North Korean systems."

It's more likely Rivts was a prototype or learning project, as indicated by the word "test" in multiple places, he notes, observing that the virus also doesn't have a backdoor, as many attacks from North Korea do. While Rivts "doesn't rank highly" on the threat scale, Doman says, it serves as a reminder that once a worm is released, it continues to spread for a long time.

JML Virus

It's possible Rivts is a new version of an early file-infector called the JML virus, another homemade attack from North Korea, according to Doman. JML, which started on Visual C++5.0 and MASM 6.0, was reportedly created in 1997 as part of a student's university project and later became a North Korean military standard. Mutations of the virus have spread outside the DPRK ever since.

"It's not interesting in terms of damage … it's interesting in terms of how far it could go," says Doman of JML. "I think what happened is it was probably an accident, copied over from another system in North Korea."

He links JML and Rivts with "low confidence." Both originated in North Korea, include the word "test," and built with Visual Studio C++ 5.0, a compiler rarely seen today. However, he says technical details make it impossible to positively determine a sample of the JML virus.

Faedevour Worm

In January 2015 an independent researcher discovered the Korean Central News Agency (KCNA) was distributing a form of malware called Faedevour. Unlike Rivts and the Voice of Korea site, researchers at Kaspersky report this was an intentional compromise by an outside attacker.

Analysis by Kaspersky indicates the DarkHotel group is responsible. Faedevour, like Rivts, is a worm and contains references to DPRK software it seeks on systems, explains Doman. It copies itself across to infect network shares and USB disks. While there is a possibility both were created by DarkHotel, Doman says this "does not seem to be the most likely explanation."

Doman says Faedevour accidentally spread in a supply chain compromise in April 2017. IBM and Lenovo had both sent storage server customers USB sticks containing installation software. Later on, he says, they learned the USB sticks had been infected with the Faedevour worm. Specifically, it was infected with the same exact malware file spotted on the KCNA website.

According to Doman, it's more likely this was an accidental infection than an intentional attack by DarkHotel, which would not likely use malware that had been created, and reported on, years earlier.

WannaCry and the Brambul Malware

Doman notes WannaCry, the attack that was created by Lazarus Group and spread via SMB file-shares, shares some of the same code base as the Brambul malware variant also released by Lazarus Group over the years. He says earlier forms of WannaCry do the same brute-forcing as Brambul and, to an extent, the massive attack could be described as a variant of Brambul.

"There are so many Brambul worms bouncing around the Internet," says Doman, that WannaCry is another instance in which the attacker lost control. "I would be surprised if the guys who wrote WannaCry expected to cause this much damage around the world. They created this thing that didn’t make much money but caused a lot of damage … if I was going to try and make a lot of money, I probably wouldn't draw too much attention to myself."

Related Content:

 

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now about that mortgage refinance offer from Wells Fargo .....
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6970
PUBLISHED: 2018-08-13
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privil...
CVE-2018-14781
PUBLISHED: 2018-08-13
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723 Paradigm Revel, 523K / MMT - 723K Paradigm Revel, and 551 / MMT - 751 MiniMed 530G The models identified above, when paired with a remote controller and having the "easy bolus" and "remote bolu...
CVE-2018-15123
PUBLISHED: 2018-08-13
Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home.
CVE-2018-15124
PUBLISHED: 2018-08-13
Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device.
CVE-2018-15125
PUBLISHED: 2018-08-13
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface.