North Korean hackers Kimsuky go to great lengths to ensure that their malicious payloads are only downloaded from valid targets and not from security researchers' systems.
According to a Kaspersky report published today, the Kimsuky group has been using new techniques to filter out invalid download requests since early 2022, when the group launched a new campaign against various targets on the Korean peninsula.
The new safeguards implemented by Kimsuky are so effective that Kaspersky reports an inability to obtain the final payloads even after successfully connecting to the threat actor's command and control server.
See also: LastPass hacked: Hackers stole the company's source code
A multi-step validation scheme
The attacks detected by Kaspersky begin with a phishing email sent to politicians, diplomats, university professors and journalists in North and South Korea.
Kaspersky was able to compile a list of potential targets thanks to the recovered C2 scripts that contain some of the targets' email addresses.
The emails contain a link that takes victims to a first-stage C2 server that checks and verifies a few parameters before delivering a malicious document. If the visitor does not match the list of targets, a harmless document is displayed.
The parameters include the visitor's email address, operating system ( Windows is valid), and the “[who].txt” file dropped by the second-stage server.
At the same time, the visitor's IP address is forwarded to the second-stage C2 server as a subsequent control parameter .
See also: Hackers use Sliver toolkit as an alternative to Cobalt Strike
The document dropped by the first-stage C2 contains a malicious macro that connects the victim to the second-stage C2, retrieves the next-stage payload, and executes it with the mshta.exe process.
The payload is a .HTA file that also creates a scheduled task for automatic execution. Its function is to create a profile of the victim by checking the ProgramFiles folder paths, AV name, username, operating system version, MS Office version, .NET framework version and more.
The fingerprint result is stored in a string (“chnome”), a copy is sent to the C2 and a new payload is received and registered with a persistence mechanism.
The next payload is a VBS file that can lead the victim to a legitimate blog or, if the targets are valid, take them to the next payload-download phase.
This happens when the victim's system is checked for the existence of the unusual string "chnome", which was intentionally misspelled to serve as a unique validator that still does not arouse suspicion.
Unfortunately, Kaspersky was unable to continue from here and "bring" the next stage payload, so it remains unknown whether this would have been the last or if there were more validation steps.
The Kimsuky group is a highly sophisticated threat actor that we have recently seen developing custom malware and using Google Chrome extensions to steal emails from victims .
See also: Google, Apple, Meta, Twitter: Which collects the least user data?
The campaign analyzed by Kaspersky illustrates the elaborate techniques used by Korean hackers to thwart analysis and make tracking them much more difficult.
Information source: bleepingcomputer.com
