ESTsecurity, during the US-South Korea joint military exercise period, a North Korean hacking organization issued a red alert on attacks targeting defense industry companies

Aug 24, 2022

Disguised as genuine purchase orders or DRM documents for Korean security products, a bold cyberattack is under way

▲ Screen showing a North Korean hacking attack targeting defense contractors during the Korea-US joint exercises (Provided by ESTsoft)

ESTsecurity (CEO Jung Jin-il), an integrated security company, said that numerous signs of cyber threats targeting Korean defense contractors have been detected while the Korea-US joint military exercises are under way, and urged the companies concerned to take particular care as the danger level rises by the day.

The attack was first detected on the 22nd, when the joint exercises began, in a form disguised as a program for looking up a computer's IP and MAC address. When the file runs it does output the computer's actual network information, but in the background it covertly plants a malicious DLL module with backdoor functionality, attempting to collect internal information and exfiltrate it.

After first detecting the attack, ESTsecurity's Security Response Center (ESRC) recognized that similar variant attacks were continuing to increase, and analysis confirmed that all of them exchange malicious commands with the same US-based IP address (216.189.154[.]6).

Apparently judging that disguising the attack as a network program with an executable (EXE) extension, as in the earlier case, had limited effect, the attacker then resumed script-based (JSE, VBS) attacks with doubled extensions to make files look like PDF or XLSM documents. It also emerged that the attacker used the executable (PIF) extension technique, which commonly appears as a shortcut (LNK) icon.

The threats detected this time share almost identical malicious patterns, and it is notable that internal business documents and phrasing related to Korean defense contractors were used as bait. In particular, some of the legitimate files shown immediately after the malicious file runs were found to be encrypted with a Korean document security solution (DRM), leading some to argue that the relevant authorities need to investigate closely whether internal material already stolen is being reused in follow-up attacks.

ESRC said its investigation found this to be an extension of the so-called 'Blue Estimate' advanced persistent threat (APT) campaign, which has for several years persistently attacked the defense sector and defense contractors, pharmaceutical companies researching the coronavirus and bitcoin exchanges, explaining that North Korea's Reconnaissance General Bureau is widely known to be behind it.

Besides attacks using malicious files, a phishing address manipulated to look like a defense contractor's internal network login service was also found; the attacker had built it to closely imitate the design of the real website. On closer inspection, though, clear differences from the legitimate site exist, and looking carefully at the official URL address in particular can help determine whether a site is genuine.

An ESTsecurity ESRC representative said: "With the Korea-US joint military exercises under way, the level of North Korean cyber threat aimed at Korean defense contractors is growing bolder and more intense," urging care and adding, "Private-sector specialists working in the defense field need to recognize that they can be exposed to North Korean cyber threats at any time and to maintain a thorough cybersecurity posture at all times."

ESTsecurity has issued an emergency update adding detection of the newly discovered malicious files to its ALYac product, and is working closely with the Korea Internet & Security Agency (KISA) and other relevant authorities on measures to prevent the spread of harm.

[이스트소프트] K몬스터그룹과 ‘페르소에이아이(Perso AI)’ 글로벌 사업 확대 MOU 체결

26. 9. 11.

ESTsoft to Launch AI Assistant 'Al-Secretary' in H2... The Most User-Friendly Installable Agent

26. 8. 31.

ESTsoft Launches 'Markdot', an Essential AI-Era Utility... Read, Write, and Share AI-Friendly Markdown!

26. 8. 25.

[ESTsoft] AI for Everyone Challenge with 'Al-Secretary'... Uniting Domain Expertise in Strategic Consortium!

26. 8. 20.

ESTsoft Record-High H1 Revenue of 60.7 Billion KRW… Operating Loss Decreases by 53.3%

26. 8. 14.

Back to list

Global SaaS with AI
A scalable Human SaaS service that can be accessed from anywhere in the world using AI technology
Senior care with AI
Interactive AI human supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI human content such as new employee analysts, announcers, etc.
API business with AI
Companies can focus on their inherent customer value by providing data and solutions using AI
as an API.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Senior care with AI
A scalable Human SaaS service that can be accessed from anywhere in the world using AI technology
Senior care with AI
Interactive AI human supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Expansion of educational businesses in various fields, such as the establishment of celebrity lecture video courses, production of TOEIC speaking educational content, and AI content as a fitness training instructor
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI human content such as new employee analysts, announcers, etc.
API business with AI
We provide data and solutions utilizing AI through APIs to enable companies to focus on their intrinsic customer value.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Global SaaS with AI
A scalable Human SaaS service that can be accessed from anywhere in the world using AI technology
Senior care with AI
Interactive AI human supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' with EST AI technology, 'face transformation, makeup application, and clothing creation' through deep learning
Creating and utilizing various AI human content such as new employee analysts, announcers, etc.
API business with AI
We provide data and solutions utilizing AI through APIs to enable companies to focus on their inherent customer value.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.

Senior care with AI
A scalable Human SaaS service that can be accessed from anywhere in the world using AI technology
Senior care with AI
Interactive AI human supports guidance, consultation, and interaction both offline and online. Expanding as a service hub without language barriers in retail, tourism, entertainment, exhibitions, manufacturing, and public sectors.
Alan Agentic with AI
Artificial intelligence multi-agent that goes beyond AI search and reaches solutions for problem solving
Education with AI
Celebrity instructor video lecture creation, TOEIC speaking education content production, as a fitness training instructor
Expansion of educational businesses in various fields such as AI content
Content with AI
Implementing 'moving pictures' by applying EST AI technology, producing various AI human contents such as 'face transformation, makeup application, and clothing creation' for new employees including analysts and announcers, and utilizing them
API business with AI
Companies can focus on their inherent customer value by providing data and solutions using AI
as an API.
Software with AI
Background removal technology applied in ALSee Capture, like the smooth design of ESTsoft AI technology and ALTools products,
provides the utility environment that users want.