Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/15/2018
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

North Korea-Linked Cyberattacks Spread Out of Control: Report

New details on old cyberattacks originating from North Korea indicate several forms of malware unintentionally spread wider than authors intended.

New research points to the broader range and related collateral damage caused by North Korea-linked cyberattacks that spread out of control. Researchers believe two of these threats likely originated from North Korea; one of them was likely an external group attacking North Korea.

Analysts at AlienVault published details on multiple attacks after collecting evidence from the millions of malicious files it scans each day. All of these attacks are separate but share commonalities, including a link to the Democratic People's Republic of Korea (DPRK), and causing more harm than was likely intended.

"These are all quite different attacks," explains Chris Doman, AlienVault security researcher and threat engineer. "They're all part of a broader trend of accidental damage from North Korea."

In a blog post on the research, Doman digs into the details of all the attacks, explaining where and when they were discovered, their relation to the DPRK, and how they spread outside the author's control.

Rivts Virus

Rivts is a malware family created in 2009 and still regularly seen by AlienVault, Doman explains, noting that the new files seen today are not the result of new developments from the author but of new files being infected with the original malware.

This is a file-infecting worm that spreads across USB drives and hard drives, and attaches itself to files to continue moving, he says, adding that it was first detected in January 2011 on the Voice of Korea, the DPRK's international broadcasting service. Doman hypothesizes that Rivts leaked from this site and moved around DPRK systems for two years before escaping from the Voice of Korea.

Doman calls Rivts a "fairly boring" virus but notes an interesting detail: it initially checks for system files normally found on Windows XP but looks for two pieces of unusual software in the Windows System folder. Both are pieces of DPRK software built by the Korea Computer Center.

"It was interesting to find a piece of malware that looked for North Korean software," Doman points out. "We thought at first it was something attacking North Korean systems."

It's more likely Rivts was a prototype or learning project, as indicated by the word "test" in multiple places, he notes, observing that the virus also doesn't have a backdoor, as many attacks from North Korea do. While Rivts "doesn't rank highly" on the threat scale, Doman says, it serves as a reminder that once a worm is released, it continues to spread for a long time.

JML Virus

It's possible Rivts is a new version of an early file-infector called the JML virus, another homemade attack from North Korea, according to Doman. JML, which started on Visual C++5.0 and MASM 6.0, was reportedly created in 1997 as part of a student's university project and later became a North Korean military standard. Mutations of the virus have spread outside the DPRK ever since.

"It's not interesting in terms of damage … it's interesting in terms of how far it could go," says Doman of JML. "I think what happened is it was probably an accident, copied over from another system in North Korea."

He links JML and Rivts with "low confidence." Both originated in North Korea, include the word "test," and built with Visual Studio C++ 5.0, a compiler rarely seen today. However, he says technical details make it impossible to positively determine a sample of the JML virus.

Faedevour Worm

In January 2015 an independent researcher discovered the Korean Central News Agency (KCNA) was distributing a form of malware called Faedevour. Unlike Rivts and the Voice of Korea site, researchers at Kaspersky report this was an intentional compromise by an outside attacker.

Analysis by Kaspersky indicates the DarkHotel group is responsible. Faedevour, like Rivts, is a worm and contains references to DPRK software it seeks on systems, explains Doman. It copies itself across to infect network shares and USB disks. While there is a possibility both were created by DarkHotel, Doman says this "does not seem to be the most likely explanation."

Doman says Faedevour accidentally spread in a supply chain compromise in April 2017. IBM and Lenovo had both sent storage server customers USB sticks containing installation software. Later on, he says, they learned the USB sticks had been infected with the Faedevour worm. Specifically, it was infected with the same exact malware file spotted on the KCNA website.

According to Doman, it's more likely this was an accidental infection than an intentional attack by DarkHotel, which would not likely use malware that had been created, and reported on, years earlier.

WannaCry and the Brambul Malware

Doman notes WannaCry, the attack that was created by Lazarus Group and spread via SMB file-shares, shares some of the same code base as the Brambul malware variant also released by Lazarus Group over the years. He says earlier forms of WannaCry do the same brute-forcing as Brambul and, to an extent, the massive attack could be described as a variant of Brambul.

"There are so many Brambul worms bouncing around the Internet," says Doman, that WannaCry is another instance in which the attacker lost control. "I would be surprised if the guys who wrote WannaCry expected to cause this much damage around the world. They created this thing that didn’t make much money but caused a lot of damage … if I was going to try and make a lot of money, I probably wouldn't draw too much attention to myself."

Related Content:

 

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31476
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2021-31477
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-...
CVE-2021-32690
PUBLISHED: 2021-06-16
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This...
CVE-2021-32691
PUBLISHED: 2021-06-16
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within th...
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).