Pierluigi Paganini May 14, 2019

The North Korea-linked APT group ScarCruft (aka APT37 and Group123) continues to expand its arsenal by adding a Bluetooth Harvester.

North Korea-linked APT group ScarCruft (aka APT37, Reaper, and Group123) continues to expand its arsenal by adding a Bluetooth Harvester.

ScarCruft has been active since at least 2012, it made the headlines in early February 2018 when researchers revealed that the APT group leveraged a zero-day vulnerability in Adobe Flash Player to deliver malware to South Korean users.

Kaspersky first documented the operations of the group in 2016. Cyber attacks conducted by the APT37 group mainly targeted government, defense, military, and media organizations in South Korea.

FireEye linked the APT37 group to the North Korean government based on the following clues:

• the use of a North Korean IP;
• malware compilation timestamps consistent with a developer operating in the North Korea time
  zone (UTC +8:30) and follows what is believed to be a typical North Korean workday;
• objectives that align with Pyongyang’s interests(i.e. organizations and individuals involved in Korean
  Peninsula reunification efforts);

Researchers from FireEye revealed that the nation-state actor also targeted entities in Japan, Vietnam, and even the Middle East in 2017. The hackers targeted organizations in the chemicals, manufacturing, electronics, aerospace, healthcare, and automotive sectors.

Past attacks associated with the ScarCruft APT group involved zero-day vulnerabilities, anyway Kaspersky researchers pointed out that threat actors also used public exploits in its campaigns.

On April 2018, ScarCruft APT added a more advanced variant of an Android Trojan, dubbed KevDroid, to its arsenal.

Now Kaspersky Lab experts discovered that ScarCruft is using a “rare” Bluetooth device harvester.

Kaspersky found several victims of a recent campaign in investment and trading companies in Vietnam and Russia.

“We believe they may have some links to North Korea, which may explain why ScarCruft decided to closely monitor them. ScarCruft also attacked a diplomatic agency in Hong Kong, and another diplomatic agency in North Korea.” reads the analysis published by Kaspersky Lab. “It appears ScarCruft is primarily targeting intelligence for political and diplomatic purposes.”

“The ScarCruft group keeps expanding its exfiltration targets to steal further information from infected hosts and continues to create tools for additional data exfiltration.” continues the analysis.

“We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester. This malware is responsible for stealing Bluetooth device information.”

The Bluetooth Harvester is delivered by a downloader, it leverages the Windows Bluetooth APIs to collect information on the devices connected via Bluetooth to the compromised system.

The tool gathers several data including device name, address, class, and whether the device is connected, authenticated and remembered.

The dropper used to deliver the Bluetooth Harvester exploits a privilege escalation (CVE-2018-8120) or leverage the UACME method to bypass the Windows User Account Control (UAC) feature. Then the malware executes an installer that creates another downloader that retrieves a final payload hidden inside an image file.

“The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload. In order to evade network level detection, the downloader uses steganography. The downloaded payload is an image file, but it contains an appended malicious payload to be decrypted.” continues Kaspersky.

The final payload was a backdoor tracked by Cisco as ROKRAT that is used to download and execute other malware, execute commands, and exfiltrate data.

Kaspersky experts also discovered some overlaps with other APT groups, DarkHotel and KONNI. One of the devices infected with ScarCruft malware was previously compromised by a variant of KONNI and a few days earlier by the GreezeBackdoor, a malware belonging to DarkHotel’s arsenal.

“The ScarCruft has shown itself to be a highly-skilled and active group. It has a keen interest in North Korean affairs, attacking those in the business sector who may have any connection to North Korea, as well as diplomatic agencies around the globe.” concludes Kaspersky. “Based on the ScarCruft’s recent activities, we strongly believe that this group is likely to continue to evolve.”

Pierluigi Paganini

(SecurityAffairs – ScarCruft, Bluetooth Harvester)

[adrotate banner=”5″]

[adrotate banner=”13″]