North Korean Hackers Target Journalists With Novel Malware

The purpose of this article is to provide an analysis of the recent targeting of journalists by the North Korean state-sponsored hacking group APT37 with a new strain of malware called Goldbackdoor. APT37, also known as Ricochet Chollima, has a history of targeting media professionals specializing in the Democratic People’s Republic of Korea (DPRK). The distribution of the Goldbackdoor malware has been facilitated through phishing attacks, following the group’s previous use of the Bluelight strain. The infection process involves phishing links in emails that appear to originate from a compromised account of a former director of South Korea’s NIS. A two-stage infection process is employed to increase the difficulty of sampling payloads. APT37’s payload concealment technique, which utilizes hidden LNK files with increased file size, has presented challenges for malware detection. The identification of this new malware sample was made possible through collaboration between NK News and the security team Stairwell. The targeted nature of these attacks has raised concerns within the cybersecurity community, as it has impacted journalists‘ ability to report on North Korea. Consequently, media organizations need to remain vigilant against targeted attacks and should collaborate with security teams to effectively respond to such threats.

Key Takeaways

• APT37, a North Korean state-sponsored hacking group, has targeted journalists specializing in the DPRK.
• APT37 has developed a new malware strain called Goldbackdoor, distributed through phishing attacks, to target journalists.
• The malware campaign used a two-stage infection process and concealed the payload in hidden LNK files, making detection and analysis challenging.
• Collaboration between media organizations and security teams is crucial in responding to targeted attacks, and media organizations need to be vigilant against phishing attacks.

APT37 and Goldbackdoor

Goldbackdoor is a newly developed malware strain by APT37, a North Korean state-sponsored hacking group, which has specifically targeted journalists specializing in the DPRK, following their previous use of the malware strain Bluelight. This novel malware strain has raised concerns within the cybersecurity community. To prevent phishing attacks, media organizations need to be vigilant and implement effective prevention measures. Additionally, malware detection techniques are crucial in identifying and mitigating the impact of such attacks. The discovery of Goldbackdoor highlights the ongoing challenges faced by journalists and media organizations in reporting on North Korea. It underscores the need for collaboration between media organizations and security teams to respond effectively to targeted attacks. The cybersecurity community continues to develop detection rules and countermeasures to combat the evolving tactics employed by state-sponsored hacking groups like APT37.

History of Journalist Targeting

Previous campaigns by APT37 have consistently focused on compromising individuals within the journalism industry. The group has a track record of targeting journalists covering North Korea, utilizing various malware strains to carry out their attacks. These targeted campaigns have had a significant impact on media freedom, as journalists specializing in the DPRK and media organizations covering North Korea have been affected. The discovery of APT37’s latest malware campaign raises concerns within the cybersecurity community regarding the challenges posed by these attacks. Media organizations need to implement robust cybersecurity measures to protect against phishing attacks and two-stage infection processes. Collaboration between media organizations and security teams is crucial in responding to these threats. The ongoing development of detection rules and countermeasures by the cybersecurity community is essential in mitigating the impact on journalists‘ ability to report on North Korea and preserving media freedom.

Infection Process and Techniques

The infection process employed by APT37 and their techniques involve the use of phishing links in emails, disguised as coming from a compromised account of a former director of South Korea’s NIS, and a two-stage infection process that makes it difficult to sample payloads. Phishing emails contain links to download ZIP archives with LNK files, disguised as document icons. The emails are carefully crafted to appear as if they were edited by Kang Min-chol, the Minister of Mining Industries in North Korea. This sophisticated approach allows APT37 to exploit compromised accounts and carry out their attacks. Detection methods and countermeasures for this infection process and technique are crucial in combating APT37’s activities. The cybersecurity community is continually developing detection rules and countermeasures to enhance protection against such phishing attacks and two-stage infection processes.

Payload Concealment Challenges

Concealing the payload presents significant challenges in the detection and analysis of APT37’s phishing attacks and two-stage infection process. APT37’s utilization of hidden LNK files with increased file sizes, artificially obtained at 282.7 MB, adds complexity to the malware detection process. This concealment technique hinders the uploading of files to online malware scanning tools such as Virus Total, making it difficult to assess the true nature of the payload. The implications for malware detection are profound, as traditional methods and tools may struggle to identify and analyze the hidden LNK files effectively. This campaign highlights the need for the infosec community to develop new detection rules and countermeasures to address the evolving tactics employed by APT37. Comprehensive analysis and understanding of the concealed payload are crucial in mitigating the impact of these targeted attacks.

Collaboration with Stairwell and NK News

Collaboration between the security team Stairwell and media outlet NK News played a crucial role in uncovering the new malware sample. This collaboration has brought several benefits in the field of cybersecurity:

• Joint Expertise: The partnership between Stairwell and NK News combined the technical expertise of Stairwell’s malware analysts with the investigative skills of NK News journalists. This multidisciplinary approach helped in identifying and analyzing the novel malware strain.

• Information Sharing: By working together, Stairwell and NK News were able to share valuable information and insights. Stairwell provided technical analysis of the malware, while NK News contributed their knowledge of previous APT37 attacks on journalists. This exchange of information enhanced the understanding of the threat landscape and improved the ability to detect and mitigate future attacks.

• Increased Awareness: The collaboration between Stairwell and NK News has raised awareness about the evolving tactics and techniques used by APT37. By reporting on the malware campaign and sharing their findings, they have informed the cybersecurity community and media organizations about the ongoing threat posed by state-sponsored hackers.

This collaboration highlights the important role that journalists can play in uncovering cyber threats and the value of partnerships between media outlets and security teams in addressing these challenges.

Phishing Attacks and Compromised Accounts

In order to mitigate the risks posed by phishing attacks and compromised accounts, it is crucial for media organizations to implement effective prevention measures. These measures should focus on both employee education and technological safeguards. Employee education programs should provide journalists with comprehensive training on recognizing and avoiding phishing emails. They should also emphasize the importance of regularly updating passwords and enabling two-factor authentication. Technological safeguards, on the other hand, can include robust email filtering systems that can detect and block phishing attempts. Additionally, organizations should regularly monitor and audit their systems for any signs of compromise, such as unusual account activity or unauthorized access attempts. By implementing these preventative measures, media organizations can significantly reduce the likelihood of falling victim to phishing attacks and protect the integrity of their accounts and sensitive information.

Impact on Journalists and Media Outlets

The impact of the malware campaign on journalists specializing in the DPRK and media outlets covering North Korea raises significant concerns within the infosec community. The highly targeted nature of the attacks poses challenges for journalists in reporting on North Korea. These journalists are already operating in a challenging environment where access to reliable information is limited. The malware campaign further hampers their ability to gather and report news from the region. It also raises concerns about the safety and security of journalists working in this field. Media organizations covering North Korea are also affected by this campaign, as it disrupts their operations and compromises their ability to provide accurate and timely news coverage. To enhance cybersecurity in media organizations, strategies such as implementing robust email security measures, conducting regular security awareness training, and collaborating with cybersecurity experts can be adopted.

North Korean State-Sponsored Hacking

State-sponsored hacking groups from a certain country have been involved in cyber attacks as part of their larger strategy. North Korea, for instance, has a history of state-sponsored hacking activities and one prominent group is APT37, also known as Ricochet Chollima. These groups operate under the direction and support of the North Korean government, targeting various sectors to achieve their objectives. One of their key objectives is information control, which aligns with North Korea’s efforts to control the flow of information both within and outside the country. By targeting journalists, APT37 aims to limit the ability of media organizations to report on North Korea and shape the narrative surrounding the country. Their actions are part of a larger cyber warfare strategy employed by the North Korean government to advance their political goals and maintain control over information dissemination.

• APT37, also known as Ricochet Chollima, is a North Korean state-sponsored hacking group.
• North Korea has a history of state-sponsored hacking activities.
• APT37’s actions align with North Korea’s efforts to control information flow.
• The group aims to limit the ability of media organizations to report on North Korea.
• Their actions are part of a larger government cyber warfare strategy.

Frequently Asked Questions

What is the purpose of APT37’s targeting of journalists specializing in the DPRK?

The purpose of APT37’s targeting of journalists specializing in the DPRK is to control the flow of information and suppress unfavorable coverage. This has significant implications for media organizations, hindering their ability to report on North Korea accurately and freely.

How does the two-stage infection process used by APT37 make it harder to sample payloads?

The two-stage infection process used by APT37 makes it harder to sample payloads by introducing an additional layer of complexity and obfuscation. This process involves multiple stages of infection, making it more challenging to isolate and analyze the specific payloads involved.

What challenges do media organizations face in responding to targeted attacks like the one carried out by APT37?

Media organizations face challenges in responding to targeted attacks like the one carried out by APT37. These challenges include the potential impact on journalism, the need for vigilance against attacks, and the necessity of collaboration with security teams to effectively detect and counter such attacks.

How does the discovery of this campaign raise concerns within the infosec community?

The discovery of this campaign raises concerns within the infosec community due to its implications. The targeted nature of the attacks and the use of novel concealment techniques pose challenges for detection and analysis, highlighting the need for improved cybersecurity measures.

What role does social media play in disseminating cybersecurity news and updates?

Social media plays a crucial role in disseminating cybersecurity news and updates. It serves as a platform for influencers to share information, raising public awareness about cyber threats and promoting best practices in cybersecurity.