North Korean Hackers Target Chrome Zero-Day Vulnerability

This article discusses the targeting of a zero-day vulnerability in the Chrome browser by North Korean hackers. The vulnerability, known as CVE-2022-0609, was exploited by two North Korean hacking groups prior to the release of a patch by Google. The primary targets of these hackers were US-based organizations operating in sectors such as news media, cryptocurrency, fintech, and software vendors. To carry out their campaigns, the hackers utilized fake job opportunities from reputable companies such as Disney, Google, and Oracle. Their attacks involved the use of an exploit kit with multiple components and stages, which focused on fingerprinting the target system through obfuscated JavaScript. Various domains and websites were employed by the hackers to execute their attacks. Additionally, the attackers implemented safeguards to prevent the recovery of their exploits, including serving the exploit frame at specific times, providing unique links and IDs to recipients, and encrypting each stage with a session-specific key. The discovery of this exploit necessitated urgent patching efforts due to the significant risk it posed to the security and privacy of affected users.

Key Takeaways

• Two North Korean hacking groups exploited the Chrome zero-day vulnerability before Google released patches.
• The hackers targeted US-based organizations in sectors such as news media, cryptocurrency, fintech industries, domain registrars, web hosting providers, and software vendors.
• The hackers used an exploit kit with multiple components and stages, including obfuscated JavaScript and a sandbox escape phase.
• The attackers used various domains and websites, including fake ones related to well-known MNCs, to carry out their campaigns.

Exploit Details

The exploit used by the North Korean hackers targeted the vulnerabilities in the Chrome browser, allowing them to execute remote code on the targeted systems, which posed a significant risk to the security and privacy of affected users. The hackers employed various exploitation techniques to take advantage of the zero-day vulnerability. They utilized an exploit kit with multiple components and stages, embedding hidden iframes in their own websites and compromised websites to deliver the exploit. The kit focused on fingerprinting the target system and used obfuscated JavaScript to gather information. To prevent the recovery of their exploits, the hackers implemented several safeguards, serving the exploit frame only at specific times, providing recipients with unique links and IDs, and encrypting each stage with a session-specific key. Countermeasures against zero-day vulnerabilities are crucial to mitigate the impact of such exploits and protect users‘ systems and data.

Targeted Organizations

Several sectors, including news media, cryptocurrency, fintech industries, domain registrars, web hosting providers, and software vendors, were targeted by the hacking groups exploiting the Chrome zero-day vulnerability. These targeted organizations were chosen strategically by the North Korean hackers for various reasons. The motive behind these attacks may include gathering valuable information, financial gain through cryptocurrency theft, or disrupting critical systems. To counter these threats, organizations need to implement robust cybersecurity measures such as regular software updates, strong network defenses, employee awareness training, and multi-factor authentication. Additionally, collaboration between government agencies, cybersecurity organizations, and private sector entities is crucial to sharing threat intelligence and developing effective countermeasures against North Korean hackers. By staying vigilant and adopting proactive security practices, organizations can mitigate the risk of falling victim to these targeted attacks.

Exploit Kit Components

Exploit kit components consist of multiple stages and components, including hidden iframes, obfuscated JavaScript, and a sandbox escape phase. These components are utilized by North Korean hackers to exploit the Chrome zero-day vulnerability. The hackers embed hidden iframes containing links to the exploit kit in their own websites and compromised websites. The kit employs obfuscated JavaScript to fingerprint the target system and gather information about the client. If successful, the kit proceeds to the sandbox escape phase. This phase aims to evade security measures and gain unauthorized access to the system. The exploit kit techniques used by the hackers demonstrate their advanced capabilities in exploiting vulnerabilities and executing remote code on targeted systems. The discovery of the vulnerability prompted Google to release patches, emphasizing the importance of timely vulnerability disclosure to prevent further exploitation.

Used Domains and Websites

Domains and websites were utilized by threat actors to carry out their malicious activities. North Korean hackers targeted various sectors and organizations, using fake domains such as disneycareers[.]net, find-dreamjob[.]com, indeedus[.]org, varietyjob[.]com, and ziprecruiters[.]org. Additionally, they employed domains like blockchainnews[.]vip, chainnews-star[.]com, financialtimes365[.]com, fireblocks[.]vip, and gatexpiring[.]com. Other domains included gbclabs[.]com, giantblock[.]org, humingbot[.]io, onlynova[.]org, and teenbeanjs[.]com. These domains were used as part of the attackers‘ phishing and social engineering techniques. By impersonating well-known multinational corporations like Disney, Google, and Oracle, the hackers lured their targets into clicking on links or providing sensitive information. The use of these domains and websites highlights the need for heightened cybersecurity measures to prevent falling victim to such phishing attempts. Vigilance and awareness are crucial in mitigating the implications for cybersecurity posed by these malicious activities.

Safeguards Used

To protect their exploits and hinder recovery efforts, the threat actors implemented various safeguards. First, they served the exploit frame only at specific times, ensuring that it was not accessible at all times. Second, recipients of email campaigns received unique links and IDs, making it difficult for security researchers to track and analyze the attacks. Third, each stage of the exploit kit was encrypted with a session-specific key, adding an extra layer of complexity to the analysis process. Additionally, the attackers discontinued further stages if a previous one failed, preventing the complete execution of the exploit. These safeguards aimed to complicate the detection and analysis processes, making it more challenging for cybersecurity professionals to mitigate the impact of the exploit. The implementation of these measures highlights the sophistication and determination of the North Korean hackers in their pursuit of successful cyberattacks. Implications for cybersecurity: These safeguards underscore the need for organizations and individuals to implement robust exploit mitigation strategies, such as timely patching and regular security updates, to protect against zero-day vulnerabilities and minimize the risk of successful cyberattacks.

SWIFT System Targeted

The SWIFT system, an international bank-messaging system, was targeted by threat actors linked to a hacking group allegedly associated with a specific country. The attack on the SWIFT system was part of the activities carried out by North Korean hackers. The Lazarus group, which has been previously implicated in the Sony Pictures hack, was identified as the hacking group behind the SWIFT attack. The SWIFT system vulnerabilities were exploited by the hackers to gain unauthorized access and potentially compromise the security of the financial institutions using the system. This incident raised concerns about the security of the global financial system and the potential impact of cyberattacks on the banking industry. It highlighted the need for robust cybersecurity measures to protect critical financial infrastructure from sophisticated threat actors.

US Government Response

Prompt action was taken by the US government in response to the recent cyberattack, highlighting the importance of maintaining a robust cybersecurity posture. Recognizing the severity of the Chrome zero-day vulnerability, the US Cybersecurity and Infrastructure Security Agency (CISA) mandated government agencies to promptly patch the bug. This immediate action was crucial in protecting the security and privacy of affected users. By implementing necessary measures, such as patching vulnerabilities in software, the US government aimed to mitigate the risk posed by the exploit. This response emphasized the government’s commitment to safeguarding critical systems and networks from cyber threats. It also underscored the significance of proactive cybersecurity measures in countering sophisticated attacks and ensuring the resilience of digital infrastructure.

Impact and Prevention Efforts

Countermeasures against future zero-day vulnerabilities and the collaboration between government agencies and tech companies in patching vulnerabilities are crucial in mitigating the impact of cyberattacks. The exploitation of the Chrome zero-day vulnerability by North Korean hackers highlights the need for robust preventive measures. This incident has demonstrated the significant risk posed to the security and privacy of affected users, emphasizing the urgency of prompt patching efforts. To prevent similar exploits in the future, it is essential for government agencies and tech companies to work closely together. This collaboration can involve sharing information on vulnerabilities, developing and deploying timely patches, and implementing proactive security measures. By fostering a coordinated approach, these countermeasures can enhance the resilience of systems and protect against potential cyber threats, ultimately safeguarding critical infrastructure and user data.

Frequently Asked Questions

How did the North Korean hackers discover the Chrome zero-day vulnerability?

The discovery of the Chrome zero-day vulnerability by North Korean hackers is not specified in the given information. The focus is on the hackers‘ exploitation of the vulnerability and their targeting of various organizations and sectors.

What specific techniques or tactics did the North Korean hackers use to exploit the Chrome zero-day vulnerability?

The North Korean hackers employed remote code execution (RCE) techniques to exploit the Chrome zero-day vulnerability. They utilized an exploit kit with multiple components and stages, including obfuscated JavaScript, fingerprinting the target system, and sandbox escape tactics.

Are there any known consequences or damages caused by the North Korean hackers‘ exploitation of the Chrome zero-day vulnerability?

The exploitation of the Chrome zero-day vulnerability by North Korean hackers has led to significant consequences and damages. By executing remote code on targeted systems, the attackers compromised the security and privacy of affected users, highlighting the urgent need for patching and preventive measures.

Have the North Korean hackers targeted other software vulnerabilities besides the Chrome zero-day vulnerability?

Yes, North Korean hackers have targeted other software vulnerabilities besides the Chrome zero-day vulnerability. They have been known to exploit vulnerabilities in various software systems and applications as part of their cyber espionage and hacking campaigns.

Is there any evidence or indication of collaboration or coordination between the North Korean hackers and other hacking groups or nations?

There is evidence of collaboration and coordination between North Korean hackers and other hacking groups or nations. However, further details or specific information regarding this collaboration and coordination have not been provided in the given context.