ESTsecurity, Attention to North Korean hacking attacks disguised as invitations to broadcast on the KTV YouTube channel operated by the Ministry of Culture, Sports and Tourism

May 22, 2022

Disguised with the theme ['The Yoon Suk Yeol administration's inter-Korean policy': COVID-19 support for North Korea and the direction of inter-Korean dialogue]

▲ Screen showing a North Korea-attributed hacking attack disguised as a booking request for a KTV YouTube channel broadcast (Provided by ESTsoft)

ESTsecurity (CEO Jung Jin-il), a security specialist, said on the 23rd that a malicious HWP document disguised as a booking request to appear on a YouTube broadcast by the Korea Policy Broadcasting Institute (KTV), under the Ministry of Culture, Sports and Tourism, is circulating, and that particular care is required.

The attack was carried out disguised as an HWP document requesting an appearance on KTV's online policy current affairs journal program — that is, it impersonated a real YouTube broadcast to attack experts in the North Korea field.

Inside the malicious document file is an introduction to the program's actual host, along with an enquiry about availability to appear on Tuesday, May 24, on the theme ['The Yoon Suk Yeol administration's inter-Korean policy': COVID-19 support for North Korea and the direction of inter-Korean dialogue].

The attacker added a malicious OLE (object linking and embedding) command inside the HWP document so that when the document runs it displays a fake message window reading [This document was created in a higher version] — similar to something users see often — as an attack strategy to induce them to run it without particular suspicion.

Advanced persistent threat (APT) attacks based on HWP OLE have thus been increasing noticeably of late. Because this technique does not use a security vulnerability (exploit), however, it should be remembered that users of the latest version of Hancom Office can also be exposed to similar threats.

According to analysis by ESTsecurity's Security Response Center (ESRC), a malicious OLE file is embedded inside the HWP, and it was confirmed that batch (BAT) files and PowerShell commands inside the OLE attempt to communicate with a particular server, 'work3.b4a[.]app'. This C2 server address keeps appearing in North Korea-linked hacking cases and needs to be blocked promptly.

Comprehensive analysis of the threat data used by this attack group shows several commonalities with what the 'Geumseong 121' group used in the past, chiefly the use of Russian Yandex email along with the abuse of overseas cloud services to store personal information stolen in hacks.

It was also confirmed that the North Korea-linked hacking group 'Geumseong 121' is making active use of HWP-based malicious documents in APT attacks, and is persistently attempting covert approaches mainly to people working on North Korean human rights, activists supporting defectors and reporters at North Korea-focused media outlets.

It is worth noting that this comes as cybersecurity has rapidly emerged as a key agenda item — with President Yoon Suk Yeol and US President Joe Biden including the deterrence of hostile cyber actors and the cybersecurity of critical infrastructure as major agenda items in the joint statement of the Korea-US summit, and announcing a substantial expansion of cooperation in responding to North Korean cyber threats.

While it is true that MS Office-based malicious DOC files account for a large share of the many hacking attacks attributed to North Korea until recently, HWP-based OLE attacks are also being found one after another, so Hancom Office users who see a separate message window prompting a click need to be more careful than before and to keep their document security level set to [High] at all times.

ESRC Director Moon Jong-hyun said: "Even after the new administration took office, cybersecurity threats judged to be the work of North Korea show no sign of stopping, and more sophisticated approaches for luring hacking targets continue to evolve," adding, "North Korea-linked cyber threats aimed at the private sector in particular are escalating by the day, so strengthening public-private cooperation matters more than anything."

ESTsecurity's ESRC, meanwhile, is closely sharing related cyber threat information with the Korea Internet & Security Agency (KISA) and other relevant authorities, maintaining cooperation to prevent known threats from spreading.

Fun for the whole family! Perso Interactive at the Seocho AI Festa

26. 10. 23.

K-culture meets AI! Perso Interactive shines at the Sidae Forum (with A2O)

26. 10. 22.

JDC sLLM Contract Marks ESTsoft’s First Step in Public-Sector AI Transformation

26. 10. 21.

[ESTsoft] Wins Contract to Build JDC’s In-House Generative AI Language Model (sLLM)

26. 10. 21.

ESTsoft and BloomingGrace Launch K-Pop Video Call App “BloomingTalk,” Powered by Real-Time AI Avatars of 24 Artists

26. 10. 15.

Back to list

Global SaaS with AI
An expandable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI Avatar content such as new employee analysts, announcers, etc.
API business with AI
Companies can focus on their inherent customer value by providing data and solutions using AI
as an API.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Senior care with AI
A scalable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Expansion of educational businesses in various fields, such as the establishment of celebrity lecture video courses, production of TOEIC speaking educational content, and AI content as a fitness training instructor
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI Avatar content such as new employee analysts, announcers, etc.
API business with AI
We provide data and solutions utilizing AI through APIs to enable companies to focus on their intrinsic customer value.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Global SaaS with AI
A scalable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI Avatar content such as new employee analysts, announcers, etc.
API business with AI
We provide data and solutions utilizing AI through APIs to enable companies to focus on their inherent customer value.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Senior care with AI
An expandable AI avatar SaaS service accessible from anywhere in the world utilizing AI technology
Senior care with AI
Interactive AI Avatar supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' by applying EST AI technology, producing various AI Avatar contents such as 'face transformation, makeup application, and clothing creation' for new employees including analysts and announcers, and utilizing them
API business with AI
Companies can focus on their inherent customer value by providing data and solutions using AI
as an API.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.