New Report
Menlo Security Named a Leader in GigaOm Radar Report for Secure Enterprise Browsing
Icon Rounded Closed - BRIX Templates

Template injection attacks part 3: Following the bread crumbs to North Korea

|

Executive Summary

During October 2022, the Menlo Labs research team posted details on camouflaged template injection documents that contained a decimal IP address or used an obscure URL format to fetch the remotely hosted template. This article was a follow-up to the post detailing how weaponized template injection attacks work and how these attacks can be prevented. The weaponized documents used RTF exploit templates to deliver malware like FormBook, Snake Keylogger, and SmokeLoader.

Because the TTPs used by the weaponized document attacks had identical footprints, we performed a deep dive on the IOCs in order to fingerprint and attribute the data points to a single threat actor. Based on the attribution of the attacks and the trail of data points we uncovered, we assess with high confidence that the threat actor is operating out of North Korea and is likely tied to the Lazarus group.

History of Attacks and Attribution

During our analysis, we noticed that North Korean threat actors have used TTPs similar to the TTPs that were mentioned and seen in the IOCs from our previous blogs.

A 2020 article by Fortinet detailed how North Korean threat actors leveraged a seemingly benign Word document on South Korea’s response to Covid-19 that had a malicious macro inside to trick victims into downloading the BabyShark malware. North Korean threat actors also sent malicious emails spoofing FedEx, encouraging readers to open a PDF that was actually an executable LokiBot exflitrating data to kbfvzoboss[.]bid/alien/fre.php. This IOC can be seen being used by LokiBot in very similar attacks going back to 2018.

We also found the sample shown below on Joe Sandbox while doing research. Curiously, it shows that North Korean is the resource language, and it contains both the LokiBot URL mentioned above and a similar URL structure to the LokiBot sample: http[://]sempersim[.]su/gj8/fre.php. This sample is also related to ones we analyzed for the previous two blogs mentioned above (it is the secondary malware of this infection chain that the malicious template downloads). We noticed many of the malicious documents tended to download only a handful of secondary malware.

screenshot showing possible origin as north korea
screenshot showing resource country as north korea (from Joe Sandbox)
Image from Joe Sandbox

Inside the malicious documents we saw metadata that was repeated in all 57 samples we analyzed for both of the previous Menlo Labs blogs on template injection attacks.

screenshot of list of document properties and declared languages and language guesses (ar-sa and en-us)

While the metadata matched, we noticed some samples used camouflaged URLs with periods, while others did not. All samples analyzed also used template injection TTPs and exploited CVE-2017-0199.

chart showing email attachment going to weaponized document, which leads to malware, an infected website, and/or a template

Similar TTPs were observed being used by a North Korean APT, BlueNoroff, which is currently focusing on targeting cryptocurrency companies. Throughout its SnatchCrypto campaign, BlueNoroff stalks and studies successful cryptocurrency startups before abusing trust in business communications. The infiltration team builds a map of interactions between individuals to understand possible topics of interest. This lets them mount high-quality social engineering attacks that look like totally normal interactions. BlueNoroff compromises companies through precise identification of the necessary people and the topics they are discussing at a given time. This allows the threat to fly under the radar and not trigger any suspicion.

By manipulating trust in this way, BlueNoroff can rely on regular macro-enabled documents or older exploits. One exploit that they stick to is CVE-2017-0199. The vulnerability initially allowed automatic execution of a remote script linked to a weaponized document. The exploit relies on fetching remote content via an embedded URL inside one of the document meta files. The document fetches a remote template that is another macro-enabled document. The first one contains two Base64-encoded binary objects (one for 32-bit and 64-bit Windows) declared as image data. The second document (the remote template) contains a VBA macro that extracts one of these objects, then spawns a new process (notepad.exe) to inject and execute the binary code. The VBA macro does a cleanup by removing the binary objects and the reference to the remote template from the original document and saving it to the same file, essentially de-weaponizing the document.

chart from SecureList illustrating process for malicious document with remote template
Image from SecureList

Similar TTPs

In another separate malicious campaign that used similar TTPs, North Korea used malicious emails that appeared to be from job recruiters. Inside the malicious email was an even more malicious document, which also exploits CVE-2017-0199, just as our other samples mentioned thus far. This document executes a malicious DLL that steals victims’ information, which is then exfiltrated to one of the four command and control servers (C2). The exfiltrated data is compressed, XOR encrypted, and then Base64 encoded before being transmitted to the C2 server.

One of the malicious domains that the above malware will exfiltrate to is shopandtravelusa[.]com. It hosted a webmail login that appeared to possibly be a phishing site. This suggests that this may have been a multi-use C2 when it was being used.

screenshot of online webmail signup

If this was indeed a phishing site, it would not have been the first that North Korea had used.

On June 27, 2022, Twitter user “Phantom XSec” reported a North Korean phishing site (naver[.]challengedrive[.]42web.io) targeting “defectors” in South Korea. The link contains a Base64-encoded Google drive URL and victim email.

screenshot of redirects
screenshot of website asking to verify identity before downloading a document

The site asks you to identify yourself before you can download the malicious document, which is hosted on a Google drive link. This is a common TTP for North Korea. Analysis of the Google drive link revealed the following information:

Document ID : 1YdiX8eN2O-fiJeauLnAM8TUq4SauCGeG
[+] Creation date : 2022/04/01 01:02:00 (UTC)
[+] Last edit date : 2022/04/01 01:02:12 (UTC)
Public permissions :
reader
[+] Owner found !
Name : SungJi Lee
Email : [email protected]
Google ID : 05253374549522814493
[+] Custom profile picture !
=> https://lh3.googleusercontent.com/a/default-user=s64

Conclusion

North Korea's threat actor activity is well known for its repeated reuse of aging malicious infrastructure. We don’t anticipate a change in TTPs. While new malware and infrastructure may be added to their arsenal, the continued overlap in TTPs enables analysts to keep a close eye on cyberthreats from this nefarious nation-state.

IOCs

5db41ba68ff27106fecdc35bd577e5c541f8061af1a114264fc00c4f38a79b1f
cc4c14aa93911c2caac0d563ce0e859f113b7e0798230520be068131600cfc8f
15e6521b196423b4e1b783e48287c33a53ae055104939776d4a5f1c2a14a185f
6e9cae7c46e8a04e45fcc12469c8c6d4d3de6f6359d4cc664a0f8a96ae29d523
c8f0eff8493e6d5736038753bf6c66817be06a3cfa46f2ebac89c8e0dd438d26
d5ef9a5ee8c65d347913d486d32d17682c22414f50dd46dadca71add23d98046
2382d4957569aed12896aa8ca2cc9d2698217e53c9ab5d52799e4ea0920aa9b9
c28c56e20af8f3af825d66703cb1d4fc8d36456030398f1cf72572ca433b4e31
3df96493c7fd1a38dd1124217777d8fc9b19c35bf3c6aaebecb52505a695fcde
5ec9341b1a9d4d8e993d40587ad750b3730708e361d13b73b9c70acc008d39af
ceaa71803ef3137732970f11b8495b7a5d3a7d5f44c3a17815a243277f6dcb47
da2e65950165482cac4ac22eedde6db6997e8c9d4e1aea1b2f63f1d0b5c5c79d
ff4935f904a0c7670835cf1ebdda3512b4a86290f35b23be019fdf86bdc4dabe
4c882c0d1ea5a377d8f3f46e429205ac1842276fcb7c2ceb5f3f466292acee3b
2ef2ad47d6d7591edb38b5ec42ea09f0dcf06ad3ca3af90ae496bf368bf5f439
0b76702aa560d6a753a380cc240c69e02889180e412f415f446c7a8fbb790f1a
3ec0b41708bde4833ca1caaaff65c27e7f763328bb77bb58dde964763cd19724
dc900337b490517caa6c84ca6d8d3ad87438747fcd541b1e0284d7c7f1710659
9297cbba9606b92009b2c4b24fbb6b34cf2f301f4efd1974ea6f07d0f9eca551
41212525387db779c41f209912f8d0fa4c6e02ebcfa58bfeb150bb1354beb814
478135f91ea1eb97461249a5f060bec37337e3f01dba4ae83823800a9bff5628
122a6069baf6c45af5724fadd825ceceb19a1b6f359903c919235ebbd9a144d0
d6cf684adf559283fe355354fc243cc80d4176170fd1941a35178e311acedf1b
f6c408c2da3c2074304510d2744c788c333f2dabc90c62f069a96cd86c3ab36a
ce2f0e82e9c6d7fa3fe1956becadf794318d41fc0654ac4f3c9f80e119221e66
d54b720511091c47a46b69ba5ef86d49dc3570f89206c8984beae53274d04145
0fe3c4c8399b870683dd4720c997e108384ca84cc8de2d88b9bc9cc665835acd
ea40be4bfd388d69705eae2f60a415b1a0789135e195fbc18039009b0feae81c
a1ba066916d2e249d1c922fcec9d34b3f30fff06c795a389ea536500db3ea221
cbf506496cce384f9646d858a2bed419c4c2eec3d3b0aa9fb5fe42170a28a530
faff9ac0f5677bd244e77d21355ba0dd297af0d8fd432d06dbf6164a76156318
2e3922ebbd37eddc441bc954c697691d70021a229d4dfd93440cdbc76b1ba3b9
2d8ac9c72a2f3ff866db66821dd11df76a4140ab9f057cf3f315975aeef5b6fd
a011bb18bfc4dfd4398ff8fc7650ffa36c9ac02a9cd9e96217e96b1f5a24cbde
4d90b87a0ca6913faf34d9536bcfa73a11c569f1b66024bc74a81200ae61f0f3
f05ddce41d6169842546182ca4bbe716b4065e6ca32cbd117dbea0fbc98e290c
46625db3c2b4e2a01cdf77a8fa70edd472b88dc1cd597f6f5380d4fe8cdc4712
1577eec1a31ec75f5498a2ae559395cdb45094f6e01d8bfa25455b46bb0136e4
8046714134cee6eeca6c08b5e4a43078c3af6a665026bcdbaa5803b549a09071
6e742a3a7e5c0cde7335a4e480e60f024f891195f8dca7feded2bcd22f107e8c
307ed8235bb475f72e71a17f683dfa0a47bfcb71df04a1b616b5edcd1194b015
250be2efc8428e581bca4b2155942e11673fb2c0476df3c08e140355eeca7ab5
ec62e7fb29c5876a74ec1c2877bb694cf29afe3c455ec5b0cb0e9277b38e4567
e15bef4234d69bf977981bcb731286c94c9b8f1ee074dc0354275a779a766da6
9dabab59de3bc14547812aed04036fef916663b6b52a9a9883ae0fcaf4acadb8
7111f324b85c707521da85365d9e228e72b7fb4ee6ab9bce3ec51c2d1cd1ea55
39786d26368e09e3b2fb159bf917b0743dcbf810985f4bba1345612704b17dd1
89d4dbcd101ed36c9f0fd51085af9b0017c239c988703542a8f4e69d72ab4475
fd6098366dcbf4cbf43c88c5914ee2d21616b392089de39eb7fff7f57fbe7a6c
412f219bb2a00a90462af164d3ebc476ebd439dfba8860f9fec76c2ab164597d
3e9f3f07af9d9f690bfe1b57614cd6fce875032018e466212553fc8ec06b1996
23056b9ff268cb75e37f56eb7c79cc567152d82888d650d86b6ed8bc52d9e6dc
44d9fc4da5160a57795f1d1f5dba4eba484c53b6604a1fd656dfc72032713676
20843ed5663afb10ea1961ca94fd12a91000990f6961d146d94ee256d6eb287d
94d7759bd1c979669bf6f0355cee1b6c2ca05de6dc97b7476487d5c924554f1d
ebf0015629c3f5e55256e1e613bc7c80b1a1f3badd5aa45261e7258dbb7bc16f
b6b0864d4638d83163d64bef00feb9606b016153ce0287387e0c957ce4347bbf

Menlo Security

menlo security logo
linkedin logotwitter/x logofacebook logoSocial share icon via eMail