Yesterday, at SAS2019, BAE Systems presented findings related to DPRK SWIFT heist activity that took place in 2018. As part of this research (a leaked video of the presentation is available online), BAE included two key points not previously disclosed in the public domain:
– The existence of a PowerShell backdoor attributable to DPRK, which the researchers dubbed PowerBrace
– A possible overlap between TA505 intrusions and DPRK intrusions, suggesting a possible hand-off between the two groups.
This blog will leave a full analysis of those two points and the supporting context to the people that found them, as it’s theirs to share; however, data that may support such conclusions have been available in open source for quite some time.
In early January, VNCert issued an alert regarding attacks targeting financial institutions, containing a mix of DPRK IOCs (including a keylogger referred to as PSLogger previously analyzed by this blog), TA505 IOCs (previously published by 360 TIC), and a handful of PowerShell scripts that are generally identical aside from a handful of configuration changes. Furthermore, the aforementioned keylogger was first uploaded by a submitter (fabd7a52) in Pakistan in December 2018. That same submitter acted as the first uploader for one of the PowerShell samples identified below (b88d4d72fdabfc040ac7fb768bf72dcd), further corroborating a possible link.
Given the multi-sourced reporting overlaps and the additional Pakistan findings mentioned above, this blog assesses that the PowerShell scripts in question likely belong to the same family of DPRK-attributable malware reported by BAE systems.
A listing of selected IOCs is below the fold, alongside a few brief notes (and a script) for how to analyze the PowerShell malware.
Month: April 2019
Possible ShadowHammer Targeting (Low Confidence)
Update: The conclusions drawn below are likely incorrect (or, at the least, presented incorrectly). The post will remain up to preserve the data collected and in case additional OSINT information becomes available.
——–
Last week, this blog examined the first stage of an infection chain deployed through a supply chain attack. The malware involved in this phase of the infection chain performed an MD5 hash of infected devices’ MAC addresses and compared them to MD5s in a hardcoded database. If a match was found, the malware called out to a hardcoded C2. Since then, multiple researchers have cracked these hashes and generated the underlying plaintext MACs.
The objectives of this supply chain attack remain unknown; however, this blog has identified one (low-confidence) possibility by comparing the plaintext MAC addresses with the Wigle database, a publicly available network data repository: The MAC addresses involved may be associated with industrial processes, logistics, and technology.
The supporting data for this assessment is below, and this blog emphasizes that these are low-confidence findings based on a limited dataset; should more specific targeting and victimology become available, this post will be revised (with the original content remaining intact for retrospective analysis).