ESTsecurity (CEO Chung Sang-won), a security specialist, said on the 23rd that with the presidential election approaching, North Korea-backed hacking attempts targeting Korean professors and private-sector experts in diplomacy, security and defense are being detected day after day, and that particular care and preparation are required.
The attack attempted on February 21 was characterized by posing as a Korean military research and Northeast Asia peace association and sending people working in the field a malicious MS Word DOC document named '[Attachment] Profile form.doc'.
The attack used the typical spear phishing technique of sending by email, and to evade behavior analysis by security solutions and detection of known patterns as far as possible, the attacker set a separate password on the malicious DOC document and delivered it by email so that only the recipient could open it.
ESTsecurity's Security Response Center (ESRC) said North Korea-linked cyber threat activity designated the 'Fake Striker' threat campaign continued to be detected in February as well, and that it is conducting analysis from multiple angles to determine the attackers' intent precisely.
Looking at what the attacks actually did, it was commonly observed that to get targets to open the attached malicious document quickly, the attacker asked them to fill in a short biographical profile and send it back by the following day.
When the malicious DOC file is opened, after a password entry step a short profile form appears asking for name, affiliation, position, mobile number and photograph — it does not show the fake MS Office notice screen that malicious DOC documents usually display to induce [Enable Content] macro execution.
If the recipient who opened the document clicks the [Enable Content] button, the macro commands hidden inside the malicious file run and covertly communicate with an overseas command-and-control (C2) server built by the attacker without the user's knowledge, which can lead to unexpected hacking damage including the theft of personal information such as keystrokes and infection with further malicious files.
ESRC said the attackers are signing up to overseas Webfreehosting services offered free of charge to build C2 servers and continuously abusing them as bases for hacking attacks.
Particular care is needed because targets can be lured with information for paying a modest honorarium or with a profile form needed for outside activity, leading to a double harm in which victims themselves send their key personal information to the attacker.
This attack disguised as a profile form is a type detected steadily since 2021, and was analyzed as using macro code and infection techniques 100% identical to those used by existing North Korea-linked hacking groups.
ESTsecurity ESRC Director Moon Jong-hyun said: "In February too, North Korea-linked cyber threats aimed at people working in Korea's diplomacy, security, defense and unification fields continue to be found," adding, "With cybersecurity readiness more important than ever during the coming presidential election period in particular, it is safer to phone the sender to confirm whether they sent it before opening any email from an unfamiliar address or one not agreed in advance."
ESTsecurity, meanwhile, has completed an update covering the related malicious files in its ALYac antivirus program, and is closely sharing cyber threat information with the Korea Internet & Security Agency (KISA) and other relevant authorities to prevent known threats from spreading.
![[ESTsoft] ESTsoft provides Seven Eleven with its intelligent AI avatar “AI Mate” to test its usefulness in convenience store shopping!](https://framerusercontent.com/images/N9N0W8oRGGl0nZWld0DSqKJsdqs.webp?width=1440&height=900)
![[ESTsoft] Real-Time AI Avatar Service Perso Interactive Expands Across Public Services, Building Customized AI Services for Local Governments and Public Institutions](https://framerusercontent.com/images/Iie6Ol3RQYNZcXd8NsouLLX7TT8.webp?width=900&height=502)
