Hello world. North Korean hackers are back at it again with yet another operation, this
time they’re pretending to be Samsung employees. The North Koreans are targeting their Southern
neighbours who work for companies which make anti malware software. The aim of the game
here is to initiate a supply chain attack, in other words: inject malicious code into
antivirus software updates before they’re signed by the developer and subsequently sent
to customers.
This is of course exactly how the infamous Solar Winds hack went down, a bad actor, which
just so happens to be the Russian state sponsored hacking group “Nobelium”, managed to infect
software updates of solar winds’ Orion platform - turning pretty boring IT system management
software into a world class espionage tool. Which ended up infecting hundreds of companies
and organisations which used the software.
Whilst Russian state backed hackers are typically interested in espionage, intelligence gathering,
spying - that kind of thing. North Korean government hackers are often financially motivated,
it has even been said that “Cyber crime is now the North Korean regime’s biggest
source of income” though of course this is just a guess, and the source for this particular
article is a “former Mossad operative” - so maybe not the most reliable of sources.
But in fairness for a country with a GDP of only 18 billion dollars, their cybercrime
industry doesn’t have to be all that large for it to represent a significant source of
income for them. Also, in a previous video I covered how the North Korean state hacker
group “Lazarus” almost made off with $1 Billion dollars in cash after hacking Bangladesh’s
central bank. The only thing that screwed up that particular operation was a spelling
mistake the hackers made in a bank transfer recipient name. I’ve said it before and
I’ll say it again, once these hacker groups figure out that they’re not going to succeed
purely based off technical prowess alone, and they realise they actually need to employ
someone with some real world common sense and some basic literary skills, I’m thinking
about diablocially written phishing emails in particular, once they figure that out,
then we’re screwed.
Luckily though, the North Korean hackers are yet to figure this out, the phishing email
they used in their latest campaign being exhibit A. You would have thought the email being
written in their mother tongue would make it easier for them to come up with something
that at least reads like a genuine recruitment email being sent by Samsung, but apparently
not.
It literally just tells the recipient to check the attached form, oh and btw if you get the
job you can make up to 300 million won - about 250K USD. And that’s the email. I realise
a google translation isn’t perfect, but the context is all we’re after really. If
you open the not at all suspicious “Samsung.rar” archive, and you’ll find a pdf file - however
the pdf, according to Google, because the report in which this is all explained comes
from Google’s threat analysis group. The pdf is “malformed and did not open in a
standard PDF reader.”
When the victims responded to the initial email, saying the PDF is broken, the North
Koreans responded with, ah, you see you must use our special, “Secure PDF Reader” software.
The bad actors would then send over a version of “PDFtron” - which is legitimate PDF
software, but the North Koreans had modified it to decode an executable hidden within the
PDF file, containing malware - of course - which “uses a legit but exploited South Korean
website for Command and Control [server]”. The malware
would provide backdoor access to the infected computer, so the miscreants could basically
do as they pleased.
Unfortunately though for the North Koreans they had forgotten that they were targeting
a company which makes anti malware software, an incredibly basic social engineering attempt
like this didn’t have much of a chance of working - I say tepidly because of course
many people continue to fall for some very basic social engineering tricks. However in
this case the only thing the North Korean hackers were successful in was making it into
Google's “Threat Horizons” November report.
This isn’t the first time North Koreans have targeted the security community. They
have been observed on a few occasions trying their hand at hacking security researchers.
In those cases they were most likely after the research the researchers had been working
on, ie: the vulnerabilities their targets had uncovered.
This video was made possible by Altium Designer, the world’s number 1 PCB design software.
35 years of innovation and development has gone into this bit of kit, and it really shows.
Nothing else I’ve used comes close to the sheer breadth and depth of features. If you
dabble in PCB design at all, you have to give this a go - the routing engine even just in
of itself is just sublime. Grab your free trial via the link in the video description.
If you enjoy this kind of video make sure to help me out by fondling the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on the
super cool WiFi hack detecting widget my company made.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.