09/09/2024 | News release | Distributed by Public on 09/09/2024 22:55
Executive Summary
Lazarus has been used in public reporting as an umbrella term for threat actors from the Democratic People's Republic of Korea (DPRK), commonly referred to as North Korea. However, many of these threat actors can be classified into different groups under the Reconnaissance General Bureau (RGB) of the Korean People's Army.
Over the years, the RGB has revealed at least six threat groups that we designate as:
These groups develop their own distinct set of malware that they have used to facilitate diverse types of operations, including:
North Korean threat groups are a focus area in the 2024 MITRE ATT&CK enterprise evaluation.
This threat assessment reviews the different North Korean threat groups that we track. We'll also review 10 malware families observed in recent attacks carried out by North Korean threat groups. This includes malware for all three major operating systems: Windows, macOS and Linux.
In addition to describing each type of malware's functionality and history, we will present their execution through the lens of Palo Alto Networks Cortex XDR. We will show how Cortex protects against known North Korean malware.
Palo Alto Networks customers receive better protections from the North Korean threat groups' arsenal and the techniques discussed in this blog through Cortex XDR. Cortex XDR provides a multi-layer defense that includes behavioral threat protection and exploit protection.
Our Advanced WildFire cloud-delivered malware analysis service accurately identifies samples related to these North Korean groups as malicious. Cloud-Delivered Security Services, including Advanced URL Filtering and Advanced DNS Security, identify domains associated with this group as malicious. Prisma Cloud leverages the power of XSIAM through the Cloud Security Agent (CSA) to better protect against novel malware.
If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.
North Korean Threat Groups Under the RGB
North Korean threat group activity is often referred to as Lazarus or the Lazarus Group in public reports. However, most of this activity is reportedly conducted by groups under the RGB, an organization that falls under the General Staff Bureau of the DPRK Korean People's Army.
These groups support the North Korean government through a combination of espionage, financial gain and geopolitical disruption. Some of the significant operations executed by these groups across the years include:
These groups have been reportedly active as early as 2007 [PDF]. Activity under the RGB can be categorized into at least six threat groups:
These groups have evolved over the years, and we often find overlaps in the tactics, techniques and tools. Figure 1 shows a simplified organizational chart for these groups under the RGB.
These North Korean threat groups use a wide arsenal of tools that span across the Windows, Linux and macOS platforms.
MITRE ATT&CK Enterprise Evaluation
MITRE chose North Korean threat groups as one of the focus areas for this year's MITRE ATT&CK enterprise evaluation. In this threat assessment, we focus on North Korean threat groups due to their worldwide reach and the impact of their operation on multiple industries and across multiple regions.
We chose the top 10 most recently active types of malware from North Korean threat groups. This threat assessment includes a brief technical analysis for each type of malware, and it shows how Cortex XDR detects and prevents these threats.
Recent North Korean Malware Arsenal Analysis
MacOS Malware
RustBucket
Malware type: Backdoor
Group affiliation: Alluring Pisces
First seen: 2023
OS type: macOS
Description:
RustBucket is macOS malware first reported in 2023. Since then, multiple variants of the malware have been observed in the wild. Most RustBucket infections are composed of three stages.
The first stage usually is an AppleScript file contained inside an application or inside a ZIP archive masquerading as a legitimate file. This AppleScript file is responsible for retrieving the second stage downloader.
The second stage downloader masquerades as a PDF viewer application. Some variants of this second stage downloader are written in Swift, while others are written in Objective-C.
The third stage is the final payload retrieved by the second stage downloader. Figure 2 shows an alert from Cortex XDR that blocks a RustBucket sample from downloading the next stage of malware.
The third stage payloads are Mach-O binaries written in Rust, hence the name RustBucket. Later variants of stage three employ persistence via a LaunchAgent, a feature that did not exist in older variants. Stage three has two main commands:
KANDYKORN
Malware type: Backdoor
Group affiliation: Alluring Pisces
First seen: 2023
OS type: macOS
Description:
First discovered in 2023, KANDYKORN is the payload of a five-stage infection chain targeting macOS systems. Known infections of KANDYKORN start with social engineering, tricking the victim into downloading a malicious ZIP archive containing a malicious Python script. If the victim executes the Python file, it downloads stage two of the infection, which is a second Python script that is saved into a folder named _log.
The second stage of the infection involves two additional Python scripts. The first Python script saved to the _logdirectory downloads another script saved to the /Users/Shared/directory, which in turn downloads a stage three file, saving it as /Users/shared/.sld.
Stage three of the infection is a downloader and loader dubbed SUGARLOADER. For persistence, SUGARLOADER saves itself as /Users/shared/.log.
Upon execution, SUGARLOADER checks for the existence of a configuration file at /Library/Caches/com.apple.safari.ck. If that configuration file is missing, SUGARLOADER downloads it using a default IP address provided in the command line.
The configuration file at /Library/Caches/com.apple.safari.ckcontains the location to download the next stage from. In Figure 3, we see part of a Cortex XDR alert that reveals the installation of this configuration file.
Cortex XDR detects SUGARLOADER installing its configuration file and alerts on staged malware activity as shown below in Figure 4.
After installing its configuration file, SUGARLOADER downloads a malware binary for HLOADER.
HLOADER functions as the persistence mechanism for KANDYKORN. HLOADER attempts to masquerade as Discord by replacing the legitimate application and renaming itself Discord. Figure 5 shows the Cortex XDR preventing this name change by HLOADER.
If the legitimate Discord application already exists on the victim's host, HLOADER will rename the legitimate Discord file to a different name, so it can take over the Discordfile name. Figure 6 shows two actions from a Cortex XDR alert where HLOADER renamed the legitimate Discord app to a new name (the bottom file event). It then renamed itself to take the place of the legitimate Discord file (the top file event).
Because Discord usually boots with the operating system, if this file renaming is successful, HLOADER will run instead of the legitimate Discord application upon booting or rebooting. If Discord is already installed on the victim's system, HLOADER will also execute the newly renamed legitimate Discord application when booting or rebooting.
In the final stage of the attack, SUGARLOADER downloads KANDYKORN and loads it into memory by using reflective loading. KANDYKORN is the final payload and possesses several capabilities, including information gathering, data exfiltration and arbitrary command execution.
SmoothOperator
Malware type: Backdoor
Group affiliation: Undetermined, under RGB
First seen: 2023
OS type: macOS
Description:
In the beginning of 2023, multiple vendors discovered Trojanized macOS installers for the legitimate 3CX client application known as 3CXDesktopApp. These Trojanized installers contained multi-staged malware called SmoothOperator.
SmoothOperator can execute payloads and extract data related to 3CX from infected hosts. It is written in Objective-C and targets 64-bit Intel-based macOS users.
The Trojanized component of SmoothOperator inside the 3CXDesktopApp application is a module called libffmpeg.dylib, which is a legitimate dependency that appears to have been altered or tampered with by the threat actors. The main purpose of this tampered libffmpeg.dylibfile is to collect the infected device's environment information and to deliver additional payloads.
When downloading an additional payload, the module writes the payload into a file named UpdateAgentand executes it. Below, Figure 7 shows disassembled code from a tampered libffmpeg.dylibfile related to saving the follow-up payload as UpdateAgent.
UpdateAgentcollects the victim's 3CX account information, then it removes itself. The relatively limited capabilities of UpdateAgentlikely prevent it from deploying a wide variety of payloads, and we have only noted SmoothOperator as the final payload from this infection chain. Figure 8 shows a Cortex XDR alert detecting a 3CX desktop app for SmoothOperator.
ObjCShellz
Malware type: Backdoor
Group affiliation: Alluring Pisces
First seen: 2023
OS type: macOS
Description:
ObjCShellz is a relatively simple backdoor Jamf Threat Labs discovered and named in November 2023. It serves as a remote shell and allows an attacker to execute arbitrary commands. Attackers reportedly deliver ObjCShellz as a second stage payload to an already compromised system.
Like other macOS malware, ObjCShellz is written in Objective-C. Jamf Threat Labs reported attackers using it as a part of the RustBucket campaign. Figure 9 below shows a Cortex XDR alert detecting a sample of ObjCShellz.
Fullhouse
Malware type: Backdoor
Group affiliation: Slow Pisces
First seen: 2023
OS type: macOS
Description:
Reported by Mandiant in 2023, Fullhouse is an HTTP backdoor written in C/C++, and it was seen as a part of a supply chain attack. Delivered as a first-stage backdoor, Fullhouse supports the execution of arbitrary commands and in turn delivers other second-stage backdoors.
Disassembled code from a Fullhouse sample reveals some unimplemented functions, such as MyFunctionStealthCodeArea, shown in Figure 10. Parts of this code also retrieve the shell environment variable, noted in the line containing getenv("SHELL").
Below, Figure 11 shows a Cortex XDR alert blocking Fullhouse activity.
Multi-Platform Malware
POOLRAT
Malware type: Backdoor
Group affiliation: Gleaming Pisces
First seen: 2021
OS type: macOS and Linux
Description:
POOLRAT is a macOS and Linux backdoor first reported by CISA in 2021 as a file named prtspool, likely the final payload in an AppleJeus attack. Mandiant named this malware family POOLRAT and identified a newer sample in its analysis of the 2023 3CX supply chain attack.
Cortex XDR detects and blocks POOLRAT as shown below in Figure 12.
PondRAT
Malware type: Remote Administration Tool (RAT)
Group affiliation: Gleaming Pisces
First seen: 2021
OS type: macOS and Linux
Description:
PondRAT is the name we use for a RAT family with variants for Linux and macOS. CISA reported the earliest sample we identify as PondRAT as part of a cryptocurrency-themed Kupay Wallet macOS malware package during an AppleJeus campaign in 2021.
Analysis of malicious packages uploaded to the Python Package Index (PyPI) in February 2024 revealed another sample we identify as PondRAT. Since it first appeared in 2021, we have identified seven macOS or Linux samples as PondRAT. The Indicators of Compromise section of this article has further details.
Figure 13 depicts an alert from Cortex XDR detecting and blocking a PoolRAT sample.
Linux Malware
OdicLoader
Malware type: Downloader
Group affiliation: Selective Pisces
First seen: 2023
OS type: Linux
Description:
OdicLoader is an ELF downloader that masquerades as a PDF file by using the U+2024Unicode character (hexadecimal 0xE2 0x80 0xA4) instead of a period (hexadecimal 0x2e) with a pdffile extension. This technique can deceive the file manager in a graphical Linux environment, causing the fake PDF file to execute as an ELF when double-clicked instead of opening with a PDF viewer.
When executed, OdicLoader opens a decoy PDF with the system's default PDF viewer using xdg-open, then it downloads and executes the next stage payload.
ESET reported OdicLoader as part of a North Korean threat campaign named Operation DreamJob. Figure 14 below shows a Cortex XDR alert detecting OdicLoader.
Windows Malware
Comebacker
Malware type: Backdoor and downloader
Group affiliation: Selective Pisces
First seen: 2020
OS type: Windows
Description:
Attackers originally used Comebacker malware as part of a campaign targeting security researchers in 2020. Like PondRAT, attackers have also distributed Comebacker as malicious packages to PyPI.
Comebacker communicates with its command and control (C2) server by sending randomly generated parameter names through HTTP POST requests. During the initial connection, the client exchanges keys with the server and sends the current local time. The server then responds with multiple values, including the encrypted payload, execution instructions and an MD5 hash to verify the authenticity of the payload.
Figure 15 shows a prevention alert from Cortex XDR blocking a Comebacker sample.
CollectionRAT
Malware type: Remote Administration Tool (RAT)
Group affiliation: Jumpy Pisces
First seen: 2023
OS type: Windows
Description:
CollectionRAT is a Windows-based RAT first announced by a Cisco Talos report in 2023 that lists samples dating as early as 2021. This malware communicates with its C2 server over HTTP and uses the Microsoft Foundation Class (MFC) library as a wrapper to decrypt its malicious code.
When executed on a vulnerable host, CollectionRAT first collects system information to fingerprint the victim's environment and sends it to the C2 server. The server responds with commands for the malware that provide the attacker a wide range of capabilities.
These capabilities include:
Figure 16 below shows Cortex XDR blocking a CollectionRAT sample.
Conclusion
North Korean groups have been documented targeting various sectors worldwide, using a wide range of custom-built malware. In this article, we examined the top 10 malware families from North Korean threat groups and demonstrated how Palo Alto Networks Cortex XDR detects and prevents these threats.
Due to the severity of the risks posed by North Korean threat actors, we encourage organizations to prioritize comprehensive security strategies and invest in multi-layer security measurements. This helps safeguard against the growing threat from these types of state-sponsored threat groups.
Protections and Mitigations
Palo Alto Networks customers receive better protections against the arsenal of malware related to the DPRK threat groups described in this article.
We have implemented prevention and detection alerts for each type of malware: RustBucket, KANDYKORN, SmoothOperator, ObjCShellz, Fullhouse, POOLRAT, PondRAT, OdicLoader, Comebacker and CollectionRAT.
For Palo Alto Networks customers, our products and services provide the following coverage associated with this group include Cortex XDR and XSIAM. Cortex XDR detects user and credential-based threats by analyzing user activity from multiple data sources including the following:
Cortex XDR, Prisma Cloud and XSIAM build behavioral profiles of user activity over time with machine learning. By comparing new activity to past activity, peer activity and the expected behavior of the entity, we can detect anomalous activity indicative of credential-based attacks. Prisma Cloud leverages the power of XSIAM through the Cloud Security Agent (CSA) ensuring that your cloud endpoints are better protected from novel malware.
This combination of services also offers the following protections related to the attacks discussed in this post:
Advanced WildFire cloud-delivered malware analysis service accurately identifies the known samples as malicious. Advanced URL Filtering and Advanced DNS Security identify known URLs and domains associated with this activity as malicious.
If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:
Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.
Indicators of Compromise
RustBucket
SHA256 hashes:
SUGARLOADER
SHA256 hash:
IP address:
HLOADER
SHA256 hashes:
KANDYKORN
SHA256 hash:
SmoothOperator
Malicious 3CX DMG
SHA256 hash:
libffmpeg.dy
SHA256 hashes:
UpdateAgent
SHA256 hash:
Domains:
ObjCShellz
SHA256 hashes:
Domain:
Fullhouse Backdoor
SHA256 hash:
Domains:
IP addresses:
POOLRAT
SHA256 hashes:
URLs:
Domains:
PondRAT
SHA256 hashes:
Domains:
OdicLoader
SHA256 hashes:
Comebacker
SHA256 hash:
CollectionRAT
SHA256 hashes: