Following the Itaewon Halloween crowd crush that killed not less than 158 folks, North Korea’s state-sponsored APT37 hacking group took benefit of a beforehand unknown Web Explorer vulnerability to put in malware on the units of South Koreans attempting to be taught concerning the tragedy, in keeping with Google’s Risk Evaluation Group. The crew grew to become conscious of the latest October 31 assault after a number of South Koreans uploaded a malicious Microsoft Workplace doc to the corporate’s VirusTotal software.
APT37 took benefit of nationwide curiosity within the Itaewon tragedy by referencing the occasion in an official-looking doc. As soon as somebody opened the doc on their machine, they’d obtain a distant wealthy textual content file template which in flip would render the distant HTML utilizing Web Explorer. In keeping with Google, this can be a extensively used method for spreading exploits since 2017, because it permits hackers to benefit from Web Explorer vulnerabilities even when somebody will not be utilizing IE as their default internet browser.
Though the TAG crew didn’t have the chance to research the ultimate malware that the APT37 hackers tried to deploy in opposition to their targets, they do notice that the group is thought to make use of all kinds of malware, together with ROKRAT , BLUELIGHT and DOLPHIN. “TAG has additionally recognized different paperwork doubtless exploiting the identical vulnerability and with comparable concentrating on, which can be a part of the identical marketing campaign,” the crew added.
This isn’t the primary time that Google’s menace evaluation group has foiled an assault by North Korean hackers. In early 2021, the crew detailed a marketing campaign concentrating on safety researchers. Most not too long ago, the crew labored with the Chrome crew to handle a vulnerability utilized by two North Korean hacking frameworks to execute code remotely.
Supply : https://information.google.com/__i/rss/rd/articles/CBMic2h0dHBzOi8vbmV3cy55YWhvby5jb20vbm9ydGgta29yZWFuLWhhY2tlcnMtdGFyZ2V0LXNvdXRoLWtvcmVhbnMtZm9sbG93aW5nLWl0YWV3b24taGFsbG93ZWVuLXRyYWdlZHktMTg1MTU5MzUwLmh0bWzSAXtodHRwczovL25ld3MueWFob28uY29tL2FtcGh0bWwvbm9ydGgta29yZWFuLWhhY2tlcnMtdGFyZ2V0LXNvdXRoLWtvcmVhbnMtZm9sbG93aW5nLWl0YWV3b24taGFsbG93ZWVuLXRyYWdlZHktMTg1MTU5MzUwLmh0bWw?oc=5