Vulnerabilities / Threats

1/8/2018
02:58 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Emailed Cyberattack Targets 2018 Pyeongchang Olympics

More than 300 organizations associated with the 2018 Olympics have been hit with a targeted email campaign.

A fileless malware campaign was discovered targeting organizations associated with the upcoming 2018 winter Olympics being held in Pyeongchang, South Korea, report analysts at McAfee Advanced Threat Research. An unknown nation-state attacker is likely responsible.

The campaign's primary target was [email protected] with 337 South Korean organizations included on the BCC line. Most targets had some involvement in the Olympics, either in providing infrastructure or playing another supporting role.

This attack arrived as a spearphishing email containing a malicious Word attachment with the original file name "Organized by Ministry of Agriculture and Forestry and Pyeongchang Winter Olympics" (translated from Korean). Emails began on Dec. 22, 2017 with the most recent activity appearing on Dec. 28, when messages were sent from an IP address in Singapore.

Emails were disguised to appear to be from South Korea's National Counter-Terrorism Center (NCTC). At the time, the NCTC was conducting physical anti-terror drills to prep for the Olympics, which suggests the email is legitimate and increases the odds people will open it.

The malicious document, which contains an obfuscated Visual Basic macro, prompts recipients to open it in their version of Microsoft Word and launches a PowerShell script when "Enable Content" is clicked. Attackers used an open-source steganography tool Invoke-PSImage, released on Dec. 20, to hide malicious PowerShell code on a remote server.

This process ultimately delivers an implant, which creates an encrypted channel to the attacker's server and gives them the ability to execute commands on the victim's machine. The goal was to evade detection technologies that rely on pattern matching, researchers explain.

"Based on the use of fileless malware to weaponize steganography tools and quickly deploy it in an active attack … this is the work of a nation state," says McAfee senior analyst Ryan Sherstobitoff. At this time, there is no information to support which country is responsible.

Threat actors are casting a wide net, researchers report, and their choice of victim is significant.

"This is one notable incident where you have an attacker with the hallmarks of a nation state who took deliberate interest in conducting reconnaissance and identifying a number of targets involved with planning the winter Olympics," says Sherstobitoff.

General cybercriminals may use the upcoming Olympics as a lure to target consumers and make money, Sherstobitoff explains. This actor, with the intention of sneaking onto victims' machines, is more interested in understanding the events unfolding in the region.

"The attacker is getting an inside look at what's happening behind the scenes," Sherstobitoff says. While analysts haven't yet seen the full effect, he says this could be "potentially damaging." With the data collected, a threat actor could hold information for ransom, making it difficult to engage with them further, or cause embarrassment for the host country.

It's increasingly common to see in-memory implants using PowerShell and obfuscation to avoid detection, though researchers note this type of attack has not been previously seen targeting users in South Korea. Use of the steganography tool, which was used in this campaign less than a week after its release, implies the actors are savvy to new tools.

McAfee reports fileless threats continued to grow in Q3 and PowerShell malware grew by 119%. "The techniques [here] have significantly grown from being used infrequently to being used quite often," says Sherstobitoff. "This technique is interesting, especially when involved in high-profile, targeted attacks."

Many cyberattacks continue to exploit basic security vulnerabilities and user behavior; however, the rise in fileless threats shows more are abusing system vulnerabilities, says McAfee Labs vice president Vincent Weafer.

"By leveraging trusted applications or gaining access to native system operating tools such as PowerShell or JavaScript, attackers have made the development leap forward to take control of computers without downloading any executable files, at least in the initial stages of the attack," he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
CVE-2018-18375
PUBLISHED: 2018-10-16
goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.
CVE-2018-18376
PUBLISHED: 2018-10-16
goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.