13.05.2016 Views

THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

001398694

001398694

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

<strong>THE</strong> KORHIGH <strong>MALWARE</strong><br />

The Korhigh malware was identified around June 25 2013 in connection with investigations into other attacks on<br />

South Korean targets (13). This date coincided with the 63 rd anniversary for the start of the Korean War. It had a<br />

destructive component, capable of deleting files and overwriting the Master Boot Record (MBR) of hard drives.<br />

The malware was apparently created by a group calling itself “High Anonymous.” The following image was<br />

contained as a resource in one of the executables:<br />

There are strong similarities between the Sony malware and the malware used in the Korhigh campaign. These<br />

similarities have been reported by Korean researchers (13), but have gone largely unnoticed in the West.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!