Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

5/21/2018
05:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

North Korean Defectors Targeted with Malicious Apps on Google Play

Sun Team hacking group is behind RedDawn, which steals victims' photos and data and passes them to threat actors.

A new form of mobile malware in the Google Play app store was found targeting North Korean defectors and journalists.

McAfee researchers believe the Sun Team hacking group is responsible for the attacks, which McAfee has dubbed RedDawn. This is the second attack McAfee has seen from Sun Team this year. Back in January, McAfee's Mobile Research Team covered another form of Android malware targeting North Korean defectors and journalists, uploaded on Google Play as "unreleased" app versions. Researchers pinged the Korea Internet & Security Agency and Google, which took the malware off its app store.

More than 30,000 people defected from North Korea to South Korea in 2016, Radio Free Asia reports, and McAfee found Sun Team is still trying to plant spyware onto their devices. Because the malware was detected and removed by Google at an early stage, the number of infections on Google Play is still at less than 100. There have been no publicly reported incidents.

Researchers found three apps on Google Play uploaded by Sun Team, an attribution they made based on email accounts and Android devices from the January campaign. The attackers used cloud services to store information logs from the same test Android devices used in the January campaign, and these logs shared formatting and abbreviations with other Sun Team logs. The email address for the new malware author is also identical to other emails linked to the group.

One of the apps used in this campaign is called Food Ingredients Info; the other two are security-related. Fast AppLock steals device data and receives commands and executables from a cloud control server. AppLockFree is part of the reconnaissance stage and sets a foundation for the rest of the attack. All apps are multi-staged with several components, McAfee believes.

The apps were uploaded onto Google Play. Sun Team initially posted them on Facebook groups associated with defectors by using fake profiles, or delivered via Facebook Messenger. The apps spread to victims' friends, who are prompted to install them by a fake user and offer feedback. Once on a device, the malware uses Dropbox and Yandex to upload data and send commands, another characteristic previously seen in earlier Sun Team attacks.

"This was a very targeted attack, with significant work undertaken to identify specific individuals and groups since at least October 2017," says Raj Samani, chief scientist at McAfee. "What is concerning is the type of information gathered could reveal very sensitive information about the victims, with call recordings, photos and contacts stolen from compromised devices."

Intel on the test devices and attempted exploits uncovered more. The phones used were manufactured in different countries and held Korean apps. Exploit codes discovered in the group's cloud storage include sandbox escape, code execution, and privilege escalation exploits, with modifications showing the actors aren't advanced enough to find zero-days and write their own. But it's likely just a matter of time until they are able to do so, according to the researchers.

What experts find most concerning about this attack is the group used photos found on social media, and identities of South Koreans, to create the fake accounts that spread malware. Evidence shows people have had their identities stolen and they expect more could follow.

Who is Sun Team?

Researchers analyzed the hacking group's operations and found different versions of their malware, which started to become active in 2017 and stayed online for about two months after being removed from Google Play, they report in a blog post on their newest finding. All of their malware is spyware, built with the intention of lifting data from victims' devices. Samani suspects this is an espionage campaign.

It seems the Sun Team actors may be poorly trying to disguise themselves as South Korean. A few Korean words lifted from the malware's control server are not in South Korean vocabulary, and Dropbox account names in both campaigns were from South Korean drama or celebrities. The app descriptions in the new campaign also includes awkward Korean writing.

"These features are strong evidence that the actors behind these campaigns are not native South Koreans but are familiar with the culture and language," researchers say. While they haven't confirmed the actors' nationalities, an exposed IP address points to North Korea.

McAfee believes, based on campaign analysis, that Sun Team is separate from Lazarus Group. They think this group "is just getting started," says Samani, and this second attempt indicated they will likely come back with new tactics and strategies. Further, he notes, this incident is a sign the mobile platform is increasingly targeted and exploited.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13693
PUBLISHED: 2020-05-29
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
CVE-2020-13173
PUBLISHED: 2020-05-28
Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier creates an insecure named pipe, which allows an attacker to intercept sensitive information or possibly elevate privileges via pre-installing...
CVE-2019-6342
PUBLISHED: 2020-05-28
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
CVE-2020-11082
PUBLISHED: 2020-05-28
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
CVE-2020-5357
PUBLISHED: 2020-05-28
Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time wi...