North Korean Hackers Goal Vitality and Aerospace Industries with New MISTPEN Malware
A North Korea-linked cyber-espionage group has been noticed leveraging job-themed phishing lures to focus on potential victims in vitality and aerospace verticals and infect them with a beforehand undocumented backdoor dubbed MISTPEN.
The exercise cluster is being tracked by Google-owned Mandiant beneath the moniker UNC2970, which it stated overlaps with a menace group often called TEMP.Hermit, which can be broadly referred to as Lazarus Group or Diamond Sleet (previously Zinc).
The menace actor has a historical past of focusing on authorities, protection, telecommunications, and monetary establishments worldwide since a minimum of 2013 to gather strategic intelligence that furthers North Korean pursuits. It is affiliated with the Reconnaissance Normal Bureau (RGB).
The menace intelligence agency stated it has noticed UNC2970 singling out numerous entities situated within the U.S., the U.Okay., the Netherlands, Cyprus, Sweden, Germany, Singapore, Hong Kong, and Australia.
“UNC2970 targets victims beneath the guise of job openings, masquerading as a recruiter for distinguished firms,” it said in a brand new evaluation, including it copies and modifies job descriptions based on their goal profiles.
“Furthermore, the chosen job descriptions goal senior-/manager-level workers. This implies the menace actor goals to realize entry to delicate and confidential info that’s usually restricted to higher-level workers.”
The assault chains, also called Operation Dream Job, entail using spear-phishing lures to have interaction with victims over electronic mail and WhatsApp in an try to construct belief, earlier than sending throughout a malicious ZIP archive file that is dressed up as a job description.
In an attention-grabbing twist, the PDF file of the outline can solely be opened with a trojanized model of a authentic PDF reader software referred to as Sumatra PDF included inside the archive to ship MISTPEN by the use of a launcher known as BURNBOOK.
It is price noting that this doesn’t suggest a provide chain assault neither is there a vulnerability within the software program. Somewhat the assault has been discovered to make use of an older Sumatra PDF model that has been repurposed to activate the an infection chain.
It is a tried-and-tested technique adopted by the hacking group way back to 2022, with each Mandiant and Microsoft highlighting using a variety of open-source software program, together with PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software program installer for these assaults.
It is believed that the menace actors probably instruct the victims to open the PDF file utilizing the enclosed weaponized PDF viewer program to set off the execution of a malicious DLL file, a C/C++ launcher referred to as BURNBOOK.
“This file is a dropper for an embedded DLL, ‘wtsapi32.dll,’ which is tracked as TEARPAGE and used to execute the MISTPEN backdoor after the system is rebooted,” Mandiant researchers stated. “MISTPEN is a trojanized model of a authentic Notepad++ plugin, binhex.dll, which accommodates a backdoor.”
TEARPAGE, a loader embedded inside BURNBOOK, is liable for decrypting and launching MISTPEN. A light-weight implant written in C, MISTPEN is supplied to obtain and execute Transportable Executable (PE) information retrieved from a command-and-control (C2) server. It communicates over HTTP with the next Microsoft Graph URLs.
Mandiant additionally stated it uncovered older BURNBOOK and MISTPEN artifacts, suggesting that they’re being iteratively improved so as to add extra capabilities and permit it to fly beneath the radar. The early MISTPEN samples have additionally been utilizing compromised WordPress web sites as C2 domains.
“The menace actor has improved their malware over time by implementing new options and including a community connectivity test to hinder the evaluation of the samples,” the researchers stated.