North Korean Hackers Pivot Away From Public Cloud – Source: www.databreachtoday.com

Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime

Kimsuky, or a Related Group, Deploys XenoRAT Variant

Jayant Chakravarti (@JayJay_Tech) •
August 22, 2024    

A North Korean hacking team hastily pivoted from using publicly available cloud computing storage to its own infrastructure after security researchers unmasked a malware campaign, said Cisco Talos.

See Also: Webinar | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

The cybersecurity firm said Wednesday it uncovered an elaborate infrastructure composed of multiple servers, test environments and websites that a threat group it tracks as UAT-5394 is using to test a remote access malware dubbed MoonPeak.

The group in June shifted from using cloud services including Google Drive, OneDrive and Dropbox to systems directly under its control. They likely did this after reading research published by South Korean cybersecurity firm AhnLab in May that traces deployment of XenoRAT malware to commercial cloud services.

The group likely moved its infrastructure “to preserve their infections from potential shutdown of cloud locations by the service providers,” Talos said. The threat actor also apparently infected one of its own command-and-control servers with the QuasarRAT remote Trojan. It’s hard to say why exactly, but Talos said it believes with low confidence the threat group deliberately placed QuasarRAT on its server as a “parallel means of maintaining access.”

The firm said UAT-5394 activity overlaps with the Pyongyang threat actor commonly tracked as Kimsuky (see: Kimsuky Uses Permissive DMARC Policies to Spoof Emails).

The group is either Kimsuky itself – or a subgroup – or another North Korean hacking cluster that borrows tactics, techniques and procedures and infrastructure patterns from Kimsuky.

UAT-5394 has been distributing a variant of XenoRAT that Talos dubs MoonPeak. “While MoonPeak contains most of the functionalities of the original XenoRAT, our analysis observed consistent changes throughout the variants that shows the threat actors are modifying and evolving the code independently from the open-source version,” Talos said.

XenoRAT is an open-source remote access Trojan that enables its operators to remotely control Windows devices and perform malicious activities. The malware employs obfuscation techniques to evade detection, uses SOCKS5 proxies to communicate with the command-and-control server and can run within legitimate processes. Various threat groups use the malware code for malicious activities.

Talos researchers also uncovered another server used by UAT-5394 that hosted the latest version of MoonPeak, built as recently as July 16. Each modified variant of MoonPeak has shown greater obfuscation ability. North Korean hackers are also modifying each version of MoonPeak so that each variant only works with specific parts of its command-and-control infrastructure.