Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families

guest · Aug 9, 2018

Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families
August 09, 2018
https://securingtomorrow.mcafee.com...ed-links-among-north-koreas-malware-families/

Attacks from the online groups Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, and 10 Days of Rain are believed to have come from North Korea. But how can we know with certainty? And what connection does a DDoS and disk-wiping attack from July 4, 2009, have with WannaCry, one of the largest cyberattacks in the history of the cyber sphere?

There are many reasons to reuse malware code, which is very common in the world of cybercrime. If we take an average ransomware campaign, for example, once the campaign becomes less successful, actors often change some of basics such as using a different packer to bypass defenses. [...]
Final words
Security vendors and researchers often use different names when speaking about the same malware, group, or attack. This habit makes it challenging to group all the malware and campaigns. By taking a scientific approach, such as looking for code reuse, we can categorize our findings. We believe our research will help the security community organize the current “mess” we face in relation to North Korean malware and campaigns.
Click to expand...

Log in or Sign up

Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families

guest Guest

Log in or Sign up

Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families

guest Guest

Useful Searches