North Korean Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware

guest · Aug 18, 2021

NK Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware
August 18, 2021
https://thehackernews.com/2021/08/nk-hackers-deploy-browser-exploit-on.html

A North Korean threat actor has been discovered taking advantage of two exploits in Internet Explorer to infect victims with a custom implant as part of a strategic web compromise (SWC) targeting a South Korean online newspaper.

Cybersecurity firm Volexity attributed the attacks to a threat actor it tracks as InkySquid, and more widely known by the monikers ScarCruft and APT37. Daily NK, the publication in question, is said to have hosted the malicious code from at least late March 2021 until early June 2021.
The "clever disguise of exploit code amongst legitimate code" and the use of custom malware enables the attackers to avoid detection, Volexity researchers said.
Click to expand...

Successful exploitation resulted in the deployment of a Cobalt Strike stager and novel backdoor called BLUELIGHT.

CVE-2020-1380 (CVSS score: 7.5) - Scripting Engine Memory Corruption Vulnerability

CVE-2021-26411 (CVSS score: 8.8) - Internet Explorer Memory Corruption Vulnerability

"While SWCs are not as popular as they once were, they continue to be a weapon in the arsenal of many attackers," the researchers noted. "The use of recently patched exploits for Internet Explorer and Microsoft Edge will only work against a limited audience."
Click to expand...

Volexity: North Korean APT InkySquid Infects Victims Using Browser Exploits

Volexity recently investigated a strategic web compromise (SWC) of the website of the Daily NK (www.dailynk[.]com), a South Korean online newspaper that focuses on issues relating to North Korea. Malicious code on the Daily NK website was observed from at least late March 2021 until early June 2021.

This post provides details on the different exploits used in the SWC, as well as the payload used, which Volexity calls BLUELIGHT. Volexity attributes the activity described in this post to a threat actor Volexity refers to as InkySquid, which broadly corresponds to activity known publicly under the monikers ScarCruft and APT37.
Click to expand...

Log in or Sign up

North Korean Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware

guest Guest

Log in or Sign up

North Korean Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware

guest Guest

Useful Searches