With the ever-increasing threat of cyberattacks from various state-sponsored hacking groups, security researchers have identified a new info-stealer being used by the North Korean hacking group RedEyes. The group, also known as APT37, ScarCruft, and Reaper, has been active for nearly a decade and is affiliated with North Korea’s Ministry of State Security (MSS).
New Info-Stealer “FadeStealer”
AhnLab Security, a South Korean cybersecurity company, recently identified a new info-stealer being used by the North Korean hacking group RedEyes. Dubbed “FadeStealer,” this malware has exceptional features that allow threat actors to eavesdrop and capture audio through victims’ microphones. This new capability adds to the already extensive set of tools RedEyes employs for cyber espionage attacks.
Active since 2012, RedEyes is believed to be a state-sponsored APT group affiliated with North Korea’s Ministry of State Security (MSS). The group has been implicated in numerous cyber espionage attacks aligned with North Korea’s interests. Its focus areas include North Korean traitors and EU-based organizations.
Reported Incident
According to Cyber Security News, RedEyes recently carried out another cyber espionage attack. The group has been known for their long-standing involvement in cyber espionage attacks and this particular incident is believed to align with North Korea’s interests. The report did not disclose the targeted organization or the specifics of the attack.
The first breach in this particular cyber espionage attack was executed by the threat actor through the use of a CHM file. The file was probably part of a phishing email campaign that urged people to open it to obtain a document password, which ultimately infected their Windows computer with malware.
Backdoor Deployment
Later phases of the attack involved the deployment of an additional GoLang backdoor through another backdoor that was initially breached. This backdoor serves the purpose of allowing the threat actor access to the victim’s system and providing persistence for future attacks.
The North Korean hacking group utilized DLL sideloading, a technique that involves injecting malicious code into an already running legitimate process. In this case, the attackers used the legitimate Internet Explorer process called “ieinstal.exe,” and with the help of DLL sideloading, they injected the FadeStealer malware after installation.
Multiple threat actors utilize CHM files. While RedEyes (also known as APT37, ScarCruft, and Reaper) is one of the North Korean threat actors to use CHM files to distribute malware, it is not alone. Other North Korean threat actors also use this method. This technique is particularly effective, as CHM files are often considered trusted files and are not usually flagged by antivirus software.
As state-sponsored hacking groups continue to develop new and more potent malware, it is critical for organizations to stay vigilant and up-to-date on the latest threats. The deployment of unique malware like FadeStealer by RedEyes highlights the group’s growing capabilities and emphasizes the need for robust cybersecurity measures to keep sensitive data and systems secure.