ScarCruft continues to evolve, introduces Bluetooth harvester

guest · May 13, 2019

ScarCruft continues to evolve, introduces Bluetooth harvester
May 13, 2019
https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/

ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula. The threat actor is highly skilled and, by all appearances, quite resourceful.
Multi-stage binary infection
The ScarCruft group uses common malware delivery techniques such as spear phishing and Strategic Web Compromises (SWC). As in Operation Daybreak, this actor performs sophisticated attacks using a zero-day exploit.

One of the most notable functions of the initial dropper is to bypass Windows UAC (User Account Control) in order to execute the next payload with higher privileges. This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams.

The ScarCruft has shown itself to be a highly-skilled and active group. It has a keen interest in North Korean affairs, attacking those in the business sector who may have any connection to North Korea, as well as diplomatic agencies around the globe. Based on the ScarCruft’s recent activities, we strongly believe that this group is likely to continue to evolve.
Click to expand...

guest · Dec 6, 2021

ScarCruft APT Mounts Desktop/Mobile Double-Pronged Spy Attacks
November 29, 2021

The North Korea-linked ScarCruft advanced persistent threat (APT) group has developed a fresh, multiplatform malware family for attacking North Korean defectors, journalists and government organizations involved in Korean Peninsula affairs.

Since 2019, ScarCruft (aka APT37 or Temp.Reaper) has been using spyware dubbed Chinotto to target victims for espionage purposes, according to an analysis from Kaspersky, although the code only recently came to the attention of researchers.
Click to expand...

Chinotto is triple-pronged, with the ultimate double-pronged goal of surveilling victims across mobile and desktop.

“The actor utilized three types of malware with similar functionalities: Versions implemented in PowerShell, Windows executables and Android applications,” researchers noted in a Monday blog posting. “Although intended for different platforms, they share a similar command-and-control scheme based on HTTP communication. Therefore, the malware operators can control the whole malware family through one set of command-and-control scripts.”
Click to expand...

And finally, there’s also an Android application version of Chinotto, Kaspersky found. It comes in the form of a malicious APK that requests excessive permissions, which allows the app to collect sensitive information. This includes SMS messages, messaging app messages, contact lists, stored account information, call logs, device information and audio recordings of phone calls.

Chinotto enables the operator to steal any information across desktop and mobile, which can then be used in follow-on attacks, researchers noted:
Click to expand...

Kaspersky:
Kaspersky uncovers formerly unknown Chinotto malware targeting North Korean defectors and human rights activists

Malware linked to ScarCruft APT actor
Today Kaspersky researchers announced their discovery of a previously unknown malware, dubbed Chinotto, targeting North Korean defectors and human rights activists. The malware, operated by the Advanced Persistent Threat (APT) actor, ScarCruft, is implemented in PowerShell, Windows executables, and Android apps. It is capable of controlling and exfiltrating sensitive information from its targets. The attackers attempted to gather information and attack victims' connections using compromised social network and email accounts.
Click to expand...

ScarCruft surveilling North Korean defectors and human rights activists

One of the purposes of our team is to help individuals targeted by APT groups. This research stemmed from this kind of endeavor. Our collaboration with the local CERT allowed us to gain a unique look into ScarCruft’s infrastructure setup and allowed us to discover many technical details.

Using these findings, we found additional Android variants of the same malware, which has been invaluable in understanding and tracking ScarCruft TTPs. Moreover, while hunting for related activity, we uncovered an older set of activity dating back to mid-2020, possibly indicating that ScarCruft operations against this set of individuals have been operating for a longer period of time.
Click to expand...

Log in or Sign up

ScarCruft continues to evolve, introduces Bluetooth harvester

guest Guest

guest Guest

Log in or Sign up

ScarCruft continues to evolve, introduces Bluetooth harvester

guest Guest

guest Guest

Useful Searches