North Korean hackers exploited Internet Explorer’s zero day to spread malware • TechCrunch

According to Google’s Threat Analysis Group, North Korean state-sponsored hackers have exploited a previously unknown zero-day vulnerability in Internet Explorer to target South Korean users with malware.

Google researchers first discovered the zero-day flaw on October 31 when several people uploaded a malicious Microsoft Office document to the company’s VirusTotal tool. The documents were believed to be government reports related to the Itaewon tragedy, a crowd crush that occurred during Halloween festivities in Seoul’s Itaewon district. At least 158 ​​people were killed and 196 others were injured.

“This incident has been widely reported, and the decoy benefits from widespread public interest in the accident,” Google TAG’s Clément Lecigne and Benoit Stevens said Wednesday.

The malicious documents were designed to exploit a zero-day vulnerability in the Internet Explorer scripting engine, identified as CVE-2022-41128 with a CVSS severity rating of 8.8. When opened, the document would provide an unknown payload after downloading a remote Rich Text File (RTF) template that would render the HTML code remote using Internet Explorer.Although Internet Explorer was officially retired in June and replaced by Microsoft Edge, Office still uses the IE engine to run the JavaScript that enables the attack.

“This technique has been widely used to distribute IE exploits via Office files since 2017,” Lecigne and Stevens said. “Delivering IE exploits through this vector has the advantage of not requiring the target to use Internet Explorer as the default browser.”

The researchers added that Google reported the vulnerability to Microsoft on October 31 before it was patched a week later as part of Microsoft’s November 2022 security updates.

Google has assigned the activity of a North Korean-backed hacking group known as APT37, which has been active since at least 2012 and has previously been observed exploiting zero-day flaws to target southern users Koreans, North Korean defectors, policy makers, journalists and human rights activists. Cybersecurity firm FireEye previously said it assessed with “high confidence” that APT37 activity is being conducted on behalf of the North Korean government, noting that the group’s primary mission “is covert intelligence gathering for the support of North Korea’s strategic military, political and economic interests”. ”

While Google researchers haven’t had a chance to analyze the malware the APT37 hackers attempted to deploy against their targets, they do note that the group is known to use a wide variety of malware.

“Although we have not picked up a final payload for this campaign, we have already observed the same group delivering a variety of implants like ROKRAT, BLUELIGHT and DOLPHIN,” Lecigne and Stevens said. “APT37 implants typically abuse legitimate cloud services as a C2 channel and provide functionality typical of most backdoors.”

The Google TAG search comes after researchers from threat intelligence firm Cisco Talos revealed that the North Korean state-sponsored Lazarus hacking group – also known as APT38 – exploits the Log4Shell vulnerability. to target energy suppliers in the United States, Canada and Japan.