Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/8/2018
02:58 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Emailed Cyberattack Targets 2018 Pyeongchang Olympics

More than 300 organizations associated with the 2018 Olympics have been hit with a targeted email campaign.

A fileless malware campaign was discovered targeting organizations associated with the upcoming 2018 winter Olympics being held in Pyeongchang, South Korea, report analysts at McAfee Advanced Threat Research. An unknown nation-state attacker is likely responsible.

The campaign's primary target was [email protected] with 337 South Korean organizations included on the BCC line. Most targets had some involvement in the Olympics, either in providing infrastructure or playing another supporting role.

This attack arrived as a spearphishing email containing a malicious Word attachment with the original file name "Organized by Ministry of Agriculture and Forestry and Pyeongchang Winter Olympics" (translated from Korean). Emails began on Dec. 22, 2017 with the most recent activity appearing on Dec. 28, when messages were sent from an IP address in Singapore.

Emails were disguised to appear to be from South Korea's National Counter-Terrorism Center (NCTC). At the time, the NCTC was conducting physical anti-terror drills to prep for the Olympics, which suggests the email is legitimate and increases the odds people will open it.

The malicious document, which contains an obfuscated Visual Basic macro, prompts recipients to open it in their version of Microsoft Word and launches a PowerShell script when "Enable Content" is clicked. Attackers used an open-source steganography tool Invoke-PSImage, released on Dec. 20, to hide malicious PowerShell code on a remote server.

This process ultimately delivers an implant, which creates an encrypted channel to the attacker's server and gives them the ability to execute commands on the victim's machine. The goal was to evade detection technologies that rely on pattern matching, researchers explain.

"Based on the use of fileless malware to weaponize steganography tools and quickly deploy it in an active attack … this is the work of a nation state," says McAfee senior analyst Ryan Sherstobitoff. At this time, there is no information to support which country is responsible.

Threat actors are casting a wide net, researchers report, and their choice of victim is significant.

"This is one notable incident where you have an attacker with the hallmarks of a nation state who took deliberate interest in conducting reconnaissance and identifying a number of targets involved with planning the winter Olympics," says Sherstobitoff.

General cybercriminals may use the upcoming Olympics as a lure to target consumers and make money, Sherstobitoff explains. This actor, with the intention of sneaking onto victims' machines, is more interested in understanding the events unfolding in the region.

"The attacker is getting an inside look at what's happening behind the scenes," Sherstobitoff says. While analysts haven't yet seen the full effect, he says this could be "potentially damaging." With the data collected, a threat actor could hold information for ransom, making it difficult to engage with them further, or cause embarrassment for the host country.

It's increasingly common to see in-memory implants using PowerShell and obfuscation to avoid detection, though researchers note this type of attack has not been previously seen targeting users in South Korea. Use of the steganography tool, which was used in this campaign less than a week after its release, implies the actors are savvy to new tools.

McAfee reports fileless threats continued to grow in Q3 and PowerShell malware grew by 119%. "The techniques [here] have significantly grown from being used infrequently to being used quite often," says Sherstobitoff. "This technique is interesting, especially when involved in high-profile, targeted attacks."

Many cyberattacks continue to exploit basic security vulnerabilities and user behavior; however, the rise in fileless threats shows more are abusing system vulnerabilities, says McAfee Labs vice president Vincent Weafer.

"By leveraging trusted applications or gaining access to native system operating tools such as PowerShell or JavaScript, attackers have made the development leap forward to take control of computers without downloading any executable files, at least in the initial stages of the attack," he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2002-0390
PUBLISHED: 2019-07-21
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2002-0639. Reason: This candidate is a reservation duplicate of CVE-2002-0639. Notes: All CVE users should reference CVE-2002-0639 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.