Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

5/21/2018
05:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

North Korean Defectors Targeted with Malicious Apps on Google Play

Sun Team hacking group is behind RedDawn, which steals victims' photos and data and passes them to threat actors.

A new form of mobile malware in the Google Play app store was found targeting North Korean defectors and journalists.

McAfee researchers believe the Sun Team hacking group is responsible for the attacks, which McAfee has dubbed RedDawn. This is the second attack McAfee has seen from Sun Team this year. Back in January, McAfee's Mobile Research Team covered another form of Android malware targeting North Korean defectors and journalists, uploaded on Google Play as "unreleased" app versions. Researchers pinged the Korea Internet & Security Agency and Google, which took the malware off its app store.

More than 30,000 people defected from North Korea to South Korea in 2016, Radio Free Asia reports, and McAfee found Sun Team is still trying to plant spyware onto their devices. Because the malware was detected and removed by Google at an early stage, the number of infections on Google Play is still at less than 100. There have been no publicly reported incidents.

Researchers found three apps on Google Play uploaded by Sun Team, an attribution they made based on email accounts and Android devices from the January campaign. The attackers used cloud services to store information logs from the same test Android devices used in the January campaign, and these logs shared formatting and abbreviations with other Sun Team logs. The email address for the new malware author is also identical to other emails linked to the group.

One of the apps used in this campaign is called Food Ingredients Info; the other two are security-related. Fast AppLock steals device data and receives commands and executables from a cloud control server. AppLockFree is part of the reconnaissance stage and sets a foundation for the rest of the attack. All apps are multi-staged with several components, McAfee believes.

The apps were uploaded onto Google Play. Sun Team initially posted them on Facebook groups associated with defectors by using fake profiles, or delivered via Facebook Messenger. The apps spread to victims' friends, who are prompted to install them by a fake user and offer feedback. Once on a device, the malware uses Dropbox and Yandex to upload data and send commands, another characteristic previously seen in earlier Sun Team attacks.

"This was a very targeted attack, with significant work undertaken to identify specific individuals and groups since at least October 2017," says Raj Samani, chief scientist at McAfee. "What is concerning is the type of information gathered could reveal very sensitive information about the victims, with call recordings, photos and contacts stolen from compromised devices."

Intel on the test devices and attempted exploits uncovered more. The phones used were manufactured in different countries and held Korean apps. Exploit codes discovered in the group's cloud storage include sandbox escape, code execution, and privilege escalation exploits, with modifications showing the actors aren't advanced enough to find zero-days and write their own. But it's likely just a matter of time until they are able to do so, according to the researchers.

What experts find most concerning about this attack is the group used photos found on social media, and identities of South Koreans, to create the fake accounts that spread malware. Evidence shows people have had their identities stolen and they expect more could follow.

Who is Sun Team?

Researchers analyzed the hacking group's operations and found different versions of their malware, which started to become active in 2017 and stayed online for about two months after being removed from Google Play, they report in a blog post on their newest finding. All of their malware is spyware, built with the intention of lifting data from victims' devices. Samani suspects this is an espionage campaign.

It seems the Sun Team actors may be poorly trying to disguise themselves as South Korean. A few Korean words lifted from the malware's control server are not in South Korean vocabulary, and Dropbox account names in both campaigns were from South Korean drama or celebrities. The app descriptions in the new campaign also includes awkward Korean writing.

"These features are strong evidence that the actors behind these campaigns are not native South Koreans but are familiar with the culture and language," researchers say. While they haven't confirmed the actors' nationalities, an exposed IP address points to North Korea.

McAfee believes, based on campaign analysis, that Sun Team is separate from Lazarus Group. They think this group "is just getting started," says Samani, and this second attempt indicated they will likely come back with new tactics and strategies. Further, he notes, this incident is a sign the mobile platform is increasingly targeted and exploited.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14821
PUBLISHED: 2019-09-19
An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->l...
CVE-2019-15032
PUBLISHED: 2019-09-19
Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.
CVE-2019-15033
PUBLISHED: 2019-09-19
Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.
CVE-2019-16412
PUBLISHED: 2019-09-19
In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zero value is only enforced within the GUI.)
CVE-2019-16510
PUBLISHED: 2019-09-19
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.