THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

MALWARE ARCHEOLOGY
As research into this case progressed, it became obvious that we were tracing malware relationships back in time.
In fact, the earliest indicators we’ve found go all the way back to at least 2009.
Around this time a malware development project started that would become the backbone of intrusions and
destructive attacks against mainly South Korean targets for years to come. In fact, modern-day malware from the
same threat actor still contains traces of this first eo-malware. The initial starting points were likely publicly
available source codes for Rbot and Mydoom, found on Chinese code sharing sites like Programmers United
Develop Net (PUDN).
There is no universally adopted naming for the early generations of this family in the AV industry. Usually they are
detected as Dllbot or Npkon, but these names can also cover other families, thus our use of a different name in this
paper - KorDllbot.
We will cover the evolution of KorDllbots and related malware, and how these came to be involved in various
intrusion cases.