New Fileless Attack Targets North Korea

itman · May 14, 2017

Counter attack?

Baijiu is a newly detected stealthy threat that currently targets North Korea, and seems to have Chinese provenance. It is delivered by phishing, and comprises a downloader that is being called Typhoon together with a set of backdoors being called Lionrock.

The campaign was discovered by Cylance, and it is thought to be hitherto unknown. "Three distinctive elements of Baijiu drew and held our attention," writes Cylance in an analysis published today: "the unusual complexity of the attack; the appropriation of web hosting service GeoCities (of 1990s fame); and the use of multiple methods of obfuscation."

The phishing lure is a reference to the 2016 floods in North Korea's North Hamgyong province caused by Typhoon Lionrock. More than 100 people died, and more than 100,000 were left homeless. The lure comprises a LNK file and the reference, "2016 North Korea Hamgyung [sic] province flood insight."

The LNK file executes a Windows command that fetches and runs javascript code. The javascript downloads two DLLs also hosted on GeoCities. "Both DLLs functioned as elaborate launchers for a PowerShell script encoded within their resource sections," comments Cylance; and both used an expired certificate belonging to mywellnessmatters.com.

The PowerShell script queries further GeoCities URLs looking for named files. If none are available, the script does nothing. One of the files obtained and analyzed by Cylance was another PowerShell script responsible for delivering and executing the final payloads.

These are "full-featured backdoors that provided the attacker the ability to enumerate and manipulate files, enumerate drive and volume information, manipulate processes, enumerate and manipulate registry information, upload/download files, capture screenshots, and securely remove traces of the backdoor."
Click to expand...

http://www.securityweek.com/new-fileless-attack-targets-north-korea

boredog · May 14, 2017

I didn't even think they used Windows computers in NK.

Way to go Cylance again.

Log in or Sign up

New Fileless Attack Targets North Korea

itman Registered Member

boredog Registered Member

Log in or Sign up

New Fileless Attack Targets North Korea

itman Registered Member

boredog Registered Member

Useful Searches