Countering threats from North Korea
blog.google
Countering threats from North Korea
1–10 of 172 posts
Re: Countering threats from North Korea
#2> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included:
* Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site.
* In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click policy for each link and allow the exploit kit to only be served once.
* The exploit kit would AES encrypt each stage, including the clients’ responses with a session-specific key.
* Additional stages were not served if the previous stage failed.
Re: Countering threats from North Korea
#3> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included: * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site. * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click po…
I think it’s currently unusual but makes sense as a pretty obvious SOP for an attacker with a specific target set who is sitting on top of a pretty valuable vulnerability (RCE on a fully up to date Chrome in this instance).
They are hard to come buy and building tooling is a long and expensive process on top of everything else.
Re: Countering threats from North Korea
#4> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included: * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site. * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click po…
We see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work around automated blacklisting, but also to work out who clicked through and who might be a potential mark the next time even if they didn't completely fall for the scam.
Most of what we got was recycled RAT malware with various packers though, it didn't trend towards being particularly interesting because you usually don't need to be to catch people, at least that's my impression. Maybe it's bad toupee fallacy.
Re: Countering threats from North Korea
#5> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included: * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site. * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click po…
[deleted]
Re: Countering threats from North Korea
#6What evidence do they have that suggests these threats are coming from North Korea?
Re: Countering threats from North Korea
#7No post body was provided.
Re: Countering threats from North Korea
#8Quoted post unavailable.
[deleted]
Re: Countering threats from North Korea
#9What evidence do they have that suggests these threats are coming from North Korea?
A statement from Google.
Re: Countering threats from North Korea
#10> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included: * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site. * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click po…
We see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work a…
I am receiving increased SMS spam past week. Is connected to this exploit? Msgs are all different domains with unique ID appended.