North Korean Hackers Used IE Vulnerability to Goal South Koreans After Halloween Tragedy

Following the Itaewon Halloween crowd crush that killed not less than 158 ​​folks, North Korea’s state-sponsored APT37 hacking group took benefit of a beforehand unknown Web Explorer vulnerability to put in malware on the units of South Koreans attempting to be taught concerning the tragedy, in keeping with Google’s Risk Evaluation Group. The crew grew to become conscious of the latest October 31 assault after a number of South Koreans uploaded a malicious Microsoft Workplace doc to the corporate’s VirusTotal software.

APT37 took benefit of nationwide curiosity within the Itaewon tragedy by referencing the occasion in an official-looking doc. As soon as somebody opened the doc on their machine, they’d obtain a distant wealthy textual content file template which in flip would render the distant HTML utilizing Web Explorer. In keeping with Google, this can be a extensively used method for spreading exploits since 2017, because it permits hackers to benefit from Web Explorer vulnerabilities even when somebody will not be utilizing IE as their default internet browser.

The JavaScript vulnerability that APT37 took benefit of allowed the group to execute arbitrary code. Google notified Microsoft of day zero the identical day it grew to become conscious of it. On November 8, Microsoft launched a software program replace to repair the exploit. “We’d be remiss if we didn’t acknowledge the immediate response and patching of this vulnerability by the Microsoft crew,” Google stated.

Though the TAG crew didn’t have the chance to research the ultimate malware that the APT37 hackers tried to deploy in opposition to their targets, they do notice that the group is thought to make use of all kinds of malware, together with ROKRAT , BLUELIGHT and DOLPHIN. “TAG has additionally recognized different paperwork doubtless exploiting the identical vulnerability and with comparable concentrating on, which can be a part of the identical marketing campaign,” the crew added.

This isn’t the primary time that Google’s menace evaluation group has foiled an assault by North Korean hackers. In early 2021, the crew detailed a marketing campaign concentrating on safety researchers. Most not too long ago, the crew labored with the Chrome crew to handle a vulnerability utilized by two North Korean hacking frameworks to execute code remotely.