Google’s Threat Analysis Team (TAG) has revealed that a North Korean hacking group known as APT37 has exploited a zero-day Internet Explorer bug to infect various South Korean targets with malware. The Google team was alerted to the recent attack on October 31st when multiple users uploaded a malicious Microsoft Office document named “221031 Seoul Yongsan Itaewon incident response status (06:00).docx.” to VirusTotal . ( The Seoul incident in which 158 people were trampled at a Halloween party .) See also: Indiana sues TikTok for exposing children to inappropriate videos
When opened on victims' devices, the document delivered an unknown payload after downloading an RTF (rich text file) remote template using Internet Explorer.
Loading the HTML content delivered by the exploitallowed hackers to exploit a zero-day bug in Internet Explorer, even if the victims did not have it set as their default browser.
The zero-day bug, codenamed CVE-2022-41128, is due to a vulnerability in Internet Explorer's JavaScript that, if successfully exploited, could allow attackers to execute arbitrary code when rendering a maliciously crafted site.
Microsoft patched it on last month's Patch Tuesday, November 8. Just five days after it was given the CVE identifier following a report from TAG received on October 31.
See also: Agrius group uses Fantasy data wiper in supply chain attacks
No information about malware on users' devices
Google's TAG team was unable to analyze the final malicious payload that the North Korean hackers sent to the victims' computers. What is known is the wide variety of malware used in their attacks.
Security engineer Clement Lecigne and Benoit Stevens of Google TAG, report that “while we did not recover a final payload for this campaign, we have previously observed the same group delivering a variety of implants such as ROKRAT , BLUELIGHT, and DOLPHIN .” APT37 has been active for about a decade, and has previously been linked to the North Korean government. APT37 is known for focusing on attacks on “persons of interest” to the North Korean regime, such as individuals who disagree with the country’s policies, diplomats, journalists , human rights activists , and government officials . Source: bleepingcomputer.com
