Pierluigi Paganini
December 16, 2012
Cyber espionage is worldwide recognized one of the most concerning cyber threats mainly operated by governments to steal sensible information to foreign states and private companies.
FireEye has revealed a cyber espionage campaign, named “Sanny“, attributable to Korea that hosts command-and-control (C&C) servers used in the attacks, the C&C channel is embedded on a legitimate page belonging a Korean message board called “nboard.net.”
The security experts haven’t revealed if the real origin is North or South Korea, a fundamental factor to indicate which coalition is targeting organizations mainly in Russia, consider that around 80 percent of the victims are Russian organizations:
Identify Korea as the origin of attacks is very generic, let’s remind that North Korea internet traffic passes on Chinese network infrastructures, differently from South Korean one and that China is one of the countries most specialized in this type of offensive.
The attacks have used a malware designed to steal email, Facebook credentials and other user-profile information from Russian telecommunications, IT, and space research organizations.
According to Ali Islam, security researcher at FireEye, it not be excluded that Korea infrastructures being used as a proxy but the analysis revealed its implication;
“Though we don’t have full concrete evidence, we have identified many indicators leading to Korea as a possible origin of attack. The following are the indicators we have so far:”
The unique certainly seems to be that experts have detected a state-sponsored attack and that the attackers have demonstrated great cyber capabilities.
The hackers have chosen a public forum as a starting point for APT attacks, knowing victims’ email server (POP3/IMAP) they obtained email user credentials directly from Outlook application.
The most singular characteristic of the cyber attacks is the use of a public forum to collect the stolen information.
Ali Islam added:
“Once you have that information, you have access to employees’ emails even from outside, and that means a lot of official information,” Islam says. “It also steals other accounts credentials, all user passwords stored by Firefox for auto login.”
The channel of infection is classic, victims received a phishing message containing a malware hidden in a document apparently proposing information related to a meeting of the Association of Southeast Asian Nations. The figure below reports a document written with Cyrillic character set demonstrating the real targets of attacks.
“The exploit drops an executable, which drops another .EXE and two .DLLs, and generally creates multiple components that aggravate AV detection and cleanup.”
FireEye detected around 90 infected machines compromised through the exploit of a Microsoft Word vulnerability that allows stealing sensitive data from the victim.
“The malicious code includes different kinds of obfuscation and encryption at different levels, and sends the data back to a public message board using HTTP POST, and SMTP as fallback,” Islam says.
The data is sent to the board that does not require authentication mechanisms that make the victims visible.
Today the C&C server is still active and the attackers are monitoring it to check new victims and stolen data every couple of days deleting data once acquired.
“In the last five days, the attacker collected and deleted the data three times approximately after every two days.”
FireEye experts still continue to analyze this cyber espionage campaign … let’s wait for further interesting results.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – blacklisted apps, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
