Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

TDrop2 Attacks Suggest Dark Seoul Attackers Return

Summary: Unit 42 researchers identified TDrop2, a malware variant sharing tools, a custom base64 alphabet, and a string decryption routine with the 2013 Dark Seoul/Operation Troy campaign, in samples dating to June 2015 and in a live attack on Europe's transportation and logistics sector. The malware arrives via a trojanized video player installer, uses process hollowing against system32 executables, and pulls a second-stage payload disguised as an image file whose 'MZ' header is replaced with 'DW', with command and control running through four compromised shared-hosting servers in South Korea and Europe.

Bottom line: A toolset built for wiping hard drives and gathering military intelligence in South Korea resurfaced two years later against European transportation and logistics firms, and Unit 42 found no destructive functionality in these samples but notes the malware can download more components. The four C2 servers were compromised through out-of-date software on shared hosting, a reminder that the infrastructure behind an espionage campaign is often someone else's unpatched website.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related