Cyber Defense eMagazine February Edition for 2023

It was identified that the threat actors were exfiltrating the data to malicious domains, such as
shopandtravelusa[.]com, while they also hosted a webmail login that appeared possibly to be a phishing
site. So, it’s possible that this could have been a multi-use command-and-control server – something that
North Korean threat actors have a track record for.
For example, on 27 June 2022, Twitter user “Phantom XSec” reported that a North Korean phishing site
with a link containing a (naver[.]challengedrive[.]42web.io) was targeting “defectors” in South Korea,
showcasing a link that contained a Base64-encoded Google drive URL and victim email. The site would
then ask users to identify themselves before they were able to download the malicious Google drive link.
Threats will persist.
Our own research shows that many of the TTPs used by weaponised document attacks were not only
similar, but also had identical footprints and IOCs, allowing us to attribute the metadata to a single threat
actor.
Given the methods used and trail of data points uncovered, it is highly likely that each of the weaponised
document attack methods discussed here can be attributed to a threat actor operating out of North Korea,
likely tied to the infamous Lazarus group. North Korean cyber criminals are known for their continued
reliance on ageing malicious infrastructure.
We don’t think this will change as threat actors continue to evolve their techniques.
About the Author
Brett Raybould - EMEA Solutions Architect, Menlo Security
Brett is passionate about security and providing solutions to organisations
looking to protect their most critical assets. Having worked for over 15 years for
various tier 1 vendors who specialise in detection of inbound threats across web
and email as well as data loss prevention, Brett joined Menlo Security in 2016
and discovered how isolation provides a new approach to solving the problems
that detection-based systems continue to struggle with.
Cyber Defense eMagazine – February 2023 Edition 158
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.