ESTsecurity, alert for hacking linked to North Korea disguising as a survey for opinion gathering targeting North Korean defectors advisory committee members

May 8, 2022

A hacking attack mounted disguised as an opinion-gathering questionnaire document for North Korean defector advisory members

▲ Screen showing a North Korea-linked hacking attack disguised as a questionnaire for North Korean defector advisory members (Provided by ESTsoft)

ESTsecurity (CEO Jung Jin-il), a security specialist, said on the 9th that a North Korea-linked hacking attack based on a malicious
HWP document, disguised as an exercise gathering opinions from North Korean defector advisory members, has been found, and that particular care is required.

What characterizes this attack is that it was disguised as an opinion-gathering questionnaire for North Korean defector advisory members.
The attacker abused the OLE (object linking and embedding) function inside the HWP document, and when the document runs it displays a fake message window reading 'This document was created in a higher version'
and similar content, to induce a natural click.

That message window is something users see often in HWP documents, and clicking the [OK] button without particular suspicion exposes them directly to the hacking attack. According to analysis by ESTsecurity's Security Response Center (ESRC), a malicious OLE file is embedded inside the HWP, and the analysis also confirmed a function inside the OLE that uses batch (BAT) files and PowerShell commands to attempt communication with a particular Korean server, 'hanainternational[.]net'.

In particular, when attempting to communicate with the command-and-control (C2) server, it was found to add operating conditions to the task scheduler that work like a dormancy function, to hide external exposure as far as possible, and to use a technique of disguising itself as an ESTsoft program.

The Fighters for a Free North Korea, meanwhile, claimed to have released around one million leaflets to North Korea using 20 large balloons in the Gimpo area of Gyeonggi Province over two days on April 25 and 26; this malicious file was used in a timely way for the attack by posing as an exercise gathering opinions on that subject.

It is worth noting this cyber threat strategy of borrowing content already reported in the media in order to maximize the attack's effect.
ESRC found that, as with February's phishing attack impersonating the UN Human Rights Office, this attack also used a Korean server as an intermediate base for the hack, and that the same task scheduler name and the IDs 'PEACE' and 'Lailey' were used in common.

OLE-based attacks like this one, which do not use an HWP vulnerability as such, are still reported from time to time; because no security vulnerability is involved, all Hancom Office users — from older products to the very latest version — need to be more careful when they see a separate message window prompting a click.

The HWP attack technique and tactical commands used here in particular were analyzed as matching earlier North Korea-linked cyberattacks, and a North Korean cyber threat group was identified as being behind it. ESRC Director Moon Jong-hyun said: "Spear phishing attacks based on malicious HWP documents have declined a great deal compared with the past, but they are one threat that cannot be ignored, still seen steadily in covert targeted attacks," adding, "Because North Korea-linked cyber threats are growing by the day like this, closer public-private coordination and cooperation matters."

ESTsecurity's ESRC, meanwhile, is closely sharing related cyber threat information with the Korea Internet & Security Agency (KISA) and other relevant authorities, maintaining cooperation to prevent known threats from spreading.

Physical AI in Everyday Life: Perso Interactive at AI FESTA

26. 10. 8.

Choose a template and you're done, the content creation tool for everyone: Picnic Studio

26. 9. 14.

[ESTsoft] Signed MOU with K Monster Group to Expand Global Business of 'Perso AI'

26. 9. 11.

180 EST AI Challengers Join an Overnight Hackathon in Jeju

26. 9. 4.

[EST-SELF] Different roles, but one answer: Perso Interactive Business Division connecting people and the world ②

26. 9. 3.

Back to list

Global SaaS with AI
An expandable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI Avatar content such as new employee analysts, announcers, etc.
API business with AI
Companies can focus on their inherent customer value by providing data and solutions using AI
as an API.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Senior care with AI
A scalable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Expansion of educational businesses in various fields, such as the establishment of celebrity lecture video courses, production of TOEIC speaking educational content, and AI content as a fitness training instructor
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI Avatar content such as new employee analysts, announcers, etc.
API business with AI
We provide data and solutions utilizing AI through APIs to enable companies to focus on their intrinsic customer value.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Global SaaS with AI
A scalable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI Avatar content such as new employee analysts, announcers, etc.
API business with AI
We provide data and solutions utilizing AI through APIs to enable companies to focus on their inherent customer value.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Senior care with AI
An expandable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' by applying EST AI technology, producing various AI Avatar contents such as 'face transformation, makeup application, and clothing creation' for new employees including analysts and announcers, and utilizing them
API business with AI
Companies can focus on their inherent customer value by providing data and solutions using AI
as an API.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.