The threat landscape continues to evolve with the emergence of sophisticated threat actors. One such threat actor, Andariel, aligned with North Korea and associated with the infamous Lazarus Group, has recently been observed leveraging a previously undocumented malware called EarlyRat in phishing attacks. This article delves into the methods employed by Andariel, their connection to the Lazarus Group, and the implications of their espionage activities and involvement in cybercrime.
Infection Method and Malware Execution
Andariel employs a Log4j exploit to infect machines, facilitating the download of additional malware from its command-and-control (C2) server. By exploiting vulnerabilities in Log4j, a widely used Java-based logging utility, Andariel gains unauthorized access to target systems. The downloaded malware further strengthens Andariel’s foothold and enables malicious activities.
Background of Andariel and the Lazarus Group
Also known as Silent Chollima and Stonefly, Andariel is closely associated with North Korea’s Lab 110, a primary hacking unit that houses various subordinate elements, including APT38 (aka BlueNoroff). These entities operate under the umbrella name Lazarus Group, recognized for their involvement in high-profile cyberattacks and state-sponsored espionage.
Objectives and Activities of Andariel
While Andariel primarily conducts espionage attacks against foreign governments and military entities of strategic interest, it also engages in cybercrime to generate additional income for the sanctions-hit nation. This dual approach adds complexity to the threat landscape, as Andariel not only seeks sensitive information but also poses financial risks through the deployment of ransomware and other malicious activities.
Features and Functions of EarlyRat Malware
EarlyRat, the previously undocumented malware leveraged by Andariel, is described as a simple but limited backdoor. It is designed to collect and exfiltrate system information to a remote server while also possessing the capability to execute arbitrary commands. These functionalities grant Andariel unauthorized control over infected hosts, enabling further malicious activities and data exfiltration.
Phishing Email Propagation of EarlyRat
Kaspersky researchers have discovered that EarlyRat is propagated through phishing emails containing decoy Microsoft Word documents. This attack chain ensures that unsuspecting users are lured into opening the infected documents, leading to the execution of EarlyRat and facilitating Andariel’s access to targeted systems.
Exploitation of Log4Shell Vulnerability
The weaponization of the Log4Shell vulnerability in unpatched VMware Horizon servers by Andariel has been previously documented by AhnLab Security Emergency Response Center (ASEC) and Cisco Talos. This vulnerability, which allows for remote code execution, provides Andariel with an entry point to infiltrate networks and conduct their espionage activities.
A New Tactic in Log4j Exploitation
One fascinating aspect observed in attacks exploiting the Log4j Log4Shell vulnerability is the use of legitimate off-the-shelf tools for further exploitation. By utilizing these tools, Andariel enhances its capabilities, exploits additional vulnerabilities, and gains wider access to target systems, thereby maximizing its impact.
Complexity of Lazarus Group’s Activities
The Lazarus Group, including Andariel, demonstrates a multifaceted approach to cyber operations. While primarily recognized as an Advanced Persistent Threat (APT) group engaged in state-sponsored espionage, they are equally adept at performing typical cybercrime tasks, such as deploying ransomware. This duality heightens the complexity of the cyber threat landscape by blurring the lines between state-sponsored attacks and financially motivated cybercrime.
Andariel’s use of the undocumented malware EarlyRat and their exploitation of Log4j vulnerabilities demonstrate the evolving tactics employed by this North Korea-aligned threat actor. Operating under the Lazarus Group umbrella, Andariel poses significant risks to governments, military entities, and organizations worldwide. As the cyber threat landscape continues to evolve, it becomes crucial for organizations and security professionals to remain vigilant, update systems regularly, and implement robust security measures to mitigate the growing threat posed by Andariel and similar threat actors.