North Korean group Andariel deploys DTrack malware and Maui ransomware

guest · Aug 10, 2022

Maui ransomware linked to North Korean group Andariel
Attack origins point to April 2021 first strike on Japanese target
August 10, 2022

The Maui ransomware that has been used against US healthcare operations has been linked to Andariel, a North Korean state-sponsored threat with links to the notorious Lazarus Group.

Researchers at Kaspersky said this week they were able to trace the origins of Maui to April 2021 – a month earlier than the strain had earlier been reported. An examination of data logs also showed some interesting information as to how the attack was deployed in advance.
Click to expand...

About 10 hours before the April Maui attack, the criminals inserted a variant of the DTrack malware to the target. Kaspersky also noted the presence of the 3Proxy tool – used for accessing internal resources – for several months prior to the ransomware deployment on an unnamed Japanese housing company.

"This data point, along with others, should openly help solidify the attribution to the Korean-speaking APT Andariel, also known as Silent Chollima and Stonefly," the researchers wrote in a report.
Click to expand...

Andariel has been active since 2015, running attacks to steal data and bring in revenue for the North Korean regime. The group's targets have been primarily in South Korea and other Asian countries, as well as the lucrative American market.
Click to expand...

Kaspersky: Andariel deploys DTrack and Maui ransomware

On July 7, 2022, the CISA published an alert, entitled, “North Korean State-Sponsored Cyber Actors Use Maui Ransomware To Target the Healthcare and Public Health Sector,” related to a Stairwell report, “Maui Ransomware.” Later, the Department of Justice announced that they had effectively clawed back $500,000 in ransom payments to the group, partly thanks to new legislation. We can confirm a Maui ransomware incident in 2022, and add some incident and attribution findings.

We extend their “first seen” date from the reported May 2021 to April 15th 2021, and the geolocation of the target, to Japan. Because the malware in this early incident was compiled on April 15th, 2021, and compilation dates are the same for all known samples, this incident is possibly the first ever involving the Maui ransomware.
Click to expand...

Background
We observed the following timeline of detections from an initial target system:

2020-12-25 Suspicious 3proxy tool

2021-04-15 DTrack malware

2021-04-15 Maui ransomware

Click to expand...

Log in or Sign up

North Korean group Andariel deploys DTrack malware and Maui ransomware

guest Guest

Log in or Sign up

North Korean group Andariel deploys DTrack malware and Maui ransomware

guest Guest

Useful Searches