Cyber Defense eMagazine February Edition for 2023

The latest analysis shows that North Korean threat actors have been using tactics, techniques and
procedures (TTPs) similar to those in previous threats, sharing many of the indicators of compromise
(IOC).
A 2020 article by Fortinet revealed that previously they had been leveraging a seemingly benign Microsoft
Word document that outlined South Korea’s supposed response to COVID-19 – designed to trick victims
into downloading the BabyShark malware through a malicious macro.
In another campaign, North Korean threat actors previously sent falsified emails impersonating FedEx,
encouraging targets to open an executable disguised as a pdf that was used to exfiltrate data. Critically,
this IOC was used by LokiBot in other similar attacks dating as far back as 2018.
A sample of similar attacks on Joe Sandbox showed that the standard North Korean language, Munhwaŏ,
was the common resource language for both LokiBot and a similar URL structure.
Looking at the malicious documents, our team found that the metadata was repeated in all 57 samples
analysed, and while some used camouflaged URLs with periods and others did not, all samples used
template injection TTPs and exploited the CVE-2017-0199 vulnerability.
This similarity doesn’t end there. Kapersky’s Securelist blog also highlights the use of similar TTPs by
BlueNoroff, a North Korean APT group that targets cryptocurrency firms.
In a recent SnatchCrypto campaign, the attack group spent time analysing the inner workings of
successful cryptocurrency startups to gain an understanding of interactions between individuals and in
turn manipulate trust in communications and execute high quality social engineering attacks.
BlueNoroff has successfully leveraged macro-enabled documents or older exploits, including CVE-2017-
0199 that initially allows for the automatic execution of a remote script linked to a weaponised document.
So how does this execution work? In three steps.
Exploiting CVE-2017-0199 sees the retrieval of remote content via an embedded URL inside one of the
document meta files. This contains two Base64-encoded binary objects – one for 32-bit Windows, and
one for 64-bit Windows.
This document fetches a second remote template containing a VBA macro that extracts one of these
objects, enabling the spawn of a new process (notepad.exe) to inject and execute the binary code.
The VBA macro does a clean-up by removing the binary objects and any reference to the remote template
from the original document and saving it to the same file, essentially de-weaponising the document.
Along with the BlueNoroff example, there is evidence that a North Korean threat actor used similar TTPs
in a malicious email campaign that spoofed reach outs from job recruiters.
Each spoofed email housed malicious documents designed to again exploit CVE-2017-0199 by executing
a malicious dynamic link library (DLL) to steal victim information. Here, data would be exfiltrated,
compressed, encrypted and Base64 encoded before being transmitted to a command-and-control server.
Cyber Defense eMagazine – February 2023 Edition 157
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.