Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/16/2019
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

US Turning Up the Heat on North Korea's Cyber Threat Operations

Sanctions on North Korean nation-state hacking groups came amid reports of fresh malicious campaigns directed at US entities from the isolated nation.

The US government's move last Friday to slap sanctions on three North Korean cyber threat groups is being viewed by some security experts as a necessary but likely futile attempt to slow down state-sponsored hacking activity in that country.

The sanctions came amid reports of fresh threat activity targeted at US interests from North Korea. The US DHS and the FBI warned of new malware activity related to Hidden Cobra, a DDoS botnet previously linked to North Korea's intelligence apparatus. In another report, security vendor Prevailion said it had observed a recent expansion of a North Korean threat campaign dubbed 'Autumn Aperture' directed at US organizations in multiple industries.

The US Department of Treasury announced the sanctions against North Korea's Lazarus Group and two of its sub-groups Bluenoroff and Andarie. All three are accused of working for the Reconnaissance General Bureau (RGB) North Korea’s primary intelligence agency to support the country's missile and weapons programs.

Lazarus Group is best known for its involvement in the WannaCry 2.0 attacks of December 2017 and the crippling breach at Sony in 2014.  Security researchers believe Bluernoroff was established to earn money for the cash-strapped sanctions-hit North Korean government. The group has been linked to attacks on banks in Bangladesh, India, South Korea, Mexico and several other countries and is believed to have stolen tens of millions of dollars in these cyber heists. Andarie's mission is thought to be similar, though this group's attacks have focused on bankcard theft and ATM hacking.

In a statement announcing the sanctions, the Treasury Department described the three threat groups as being directly controlled by the North Korean government and being used to perpetuate the country's broader nuclear and military goals. The sanctions prohibit all dealings by US individuals and business with the three threat groups and any entities believed associated with them in a meaningful way. It also puts strictures on any properties or business deals the groups or their associates might have in the US.

The big question is whether the sanctions will have any deterrent impact considering the targeted groups are not based in the US nor are likely to have any meaningful assets or interests that can be seized here.

"Sanctions are, arguably ineffective and laughable," says Chris Roberts, chief security strategist at Attivo Networks.

US sanctions on North Korea for more than 25 years over its nuclear program have had little direct effect and it is likely the new ones against the three threat groups will do much to deter them, he says. Their business is breaking the law so merely telling them to stop will do little to change things on the ground Roberts notes. "Their tools, technologies and systems are in place, and anything they need they can readily get from the rest of the world with little difficulty."

John Hultquist, director of intelligence at FireEye, says over the past several years North Korea's cyber espionage apparatus has evolved into a significant state-run criminal enterprise. "North Korea has continuously improved their capability, especially with regards to their financially-motivated schemes, which often involve innovative tools and techniques," he says.

It's hard to judge the effectiveness of sanctions and indictments, which are two of the tools the US has attempted to leverage to alter the behavior of threat actors in other countries as well including in China, Russia, and Iran. Some, like China and Iran, have notably changed their behavior in the past, he notes. "But internal restructuring, or a warming relationship with the US may have caused the changes, rather than [sanctions]," he says.

Autumn Aperture Campaign

Meanwhile, Prevailion last week said it had observed a spike in activity related to Autumn Aperture, a cyber-espionage campaign targeting US organizations. The security vendor has linked the campaign with a moderate level of certainty to a North Korean advanced persistent threat group called Kimsuky or Smoke Screen.

Prevailion said its researchers have recently observed the threat actors behind the Autumn Aparture campaign using documents discussing North Korean nuclear deterrence and its nuclear submarine program as lures in malware-laden emails.

The documents that are being used are all legitimate documents written by industry experts. What the threat actors are doing is appending their malware to the documents and sending them out as attachments to targeted recipients—sometimes using obscure file formats such as Kodak FlashPix to evade detection.

Danny Adamitis, director of intelligence analysis at Prevailion, says with the latest campaign the threat actors have added functionality to check for the presence of various anti-virus products before downloading the secondary payload. "Prevailion assesses that the threat actor is a persistent threat that will continue to pose a threat to US based think tanks and their partners, particularly those involved in national security based upon historical targeting trends," Adamitis says.

The DHS and FBI last week also released alerts on malware activity tied to North Korea. The two agencies reported on an IP tunneling tool called ELECTRICFISH and a Trojan dubbed BADCALL that they described as being linked to the North Korean Hidden Cobra botnet.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Escaping Email: Unlocking Message Security for SMS, WhatsApp."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/17/2019 | 7:15:41 PM
Re: Utilize the ISP and other vendors to block countries
Well no, not in this case, if we are blocking all traffic (however, hidden or obscure), there will always be a source and destination (we are blocking everything from their country, dns and all). This can be done at the ISP or onsite, 95% of your traffic from the outside world can be blocked. Now if they use a jump host (but the ISP or Akamai would block that as well), we could alleviate this hacking, but it would have to come from a united front (if we are not doing business with them, then why am I allowing them to constantly check my network).

I am not just looking at your site, but layers of protection at the source all the way to the destination. One thing I must say, even when I blocked countries that were considered bad, the hack attempts went down from 2000+ to 5. Not sure about you, but I can deal with that (my UFW/IPTables is blocking all the rest along with SELinux).

T

 
WN2QU
50%
50%
WN2QU,
User Rank: Guru
9/17/2019 | 10:48:06 AM
Re: Utilize the ISP and other vendors to block countries
Not if they are using tools with Obfuscated Server Lists (OSL's) right? 
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/16/2019 | 8:51:53 PM
Utilize the ISP and other vendors to block countries
Shouldnt' we block country access where this is part of the sanctions imposed on North Korea. By doing so, we remove access to business in the US, this can be done at the ISP. Akamai has the ability to filter traffic at the source and PaloAlto has the ability to block countries (the entire block). With a little programming, MS Windows can do that as well by using PowerShell or NetSH.
Get-NetFirewallRule | 
Where { ($_.DisplayName -like "$RuleName-#*") -And ($_.Description -like "*Do not edit rule by hand*") } |
Remove-NetFirewallRule

# Don't create the firewall rules again if the -DeleteOnly switch was used.
if ($DeleteOnly) { Exit }

$Ranges = Get-Content $File | Where { ($_.Trim().Length -ne 0) -and ($_ -Match '^[0-9a-f]{1,4}[\.\:]') } $RangeCount = $Ranges.Count # Confirm that the InputFile had at least one IP address or IP range to block. if ($RangeCount -eq 0) { "`nThe InputFile contained no IP addresses to block, quitting...`n" Exit } $MaxRangesPerRule = 2000

I know there are ways to address the problem at the source, but it is dependent on the relationships we are trying to maintain.

T

 
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9349
PUBLISHED: 2020-04-02
The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password.
CVE-2020-11100
PUBLISHED: 2020-04-02
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
CVE-2020-11450
PUBLISHED: 2020-04-02
Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in.
CVE-2020-11451
PUBLISHED: 2020-04-02
The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and data. (This is also exploitable via SSRF.)
CVE-2020-11454
PUBLISHED: 2020-04-02
Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the app...