Korea In The Crosshairs
Summary: Cisco Talos reviewed a year of campaigns by an actor it calls Group 123, linking them through shared code and PDB compiler artifacts, with the "Golden Time", "Evil New Year", "North Korean Human Rights", "FreeMilk" and "Are You Happy?" campaigns mainly targeting South Korean users via spear phishing and malicious Hancom Hangul (HWP) documents that installed the ROKRAT remote administration tool. The FreeMilk campaign instead targeted several non-Korean financial institutions using a Microsoft Office document that exploited CVE-2017-0199 less than one month after its public disclosure, and the sixth campaign, "Are You Happy?", deployed a disk wiper that is a ROKRAT module and wipes the first sectors of the device.
Bottom line: Group 123 used CVE-2017-0199 less than one month after public disclosure and, in the "Are You Happy?" campaign, moved from espionage to a wiper that overwrites the master boot record - the same pattern seen in the December 2014 attack on a Korean power plant that displayed "Who Am I?".
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2013-0808CVE-2017-0199
- Related
- Introducing ROKRAT Cyber Risks ·Free Milk: A Highly Targeted Spear Phishing Campaign Cyber Risks ·