North Korean APT Inky Squid Infects Victims Using Browser Exploits
Summary: Volexity found malicious code on the Daily NK website, a South Korean online newspaper covering North Korea, from at least late March 2021 until early June 2021, redirecting visitors to attacker-owned subdomains of jquery[.]services. The attackers used Internet Explorer exploits CVE-2020-1380 and CVE-2021-26411 to deliver a Cobalt Strike stager, and in one case a custom malware family Volexity calls BLUELIGHT that uses the Microsoft Graph API and OneDrive for command and control, with activity attributed to InkySquid (also known as ScarCruft and APT37).
Why it matters: The malicious code was only added for short periods and swiftly removed, so the compromise was not always visible to anyone checking the site, and the BLUELIGHT implant hides its command traffic inside OneDrive folders while taking screenshots every 30 seconds for the first five minutes and then every five minutes.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2020-1380
- Related
- CVE-2020-1380: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, August 2020 Edition Cyber Risks ·