North Korea-backed Kimsuky targets unpatched BlueKeep systems in new campaign – Source: www.csoonline.com

The infamous BlueKeep flaw from 2019, tracked as CVE-2019-0708, has come back to haunt security professionals as reports of fresh, in-the-wild abuse surface.

The dangerous, “wormable” RCE flaw affecting Microsoft’s remote desktop protocol (RDP) was exploited in a new campaign by North Korea-backed Kimsuky APT,  targeting vulnerable South Korean and Japanese systems.

South Korean cybersecurity company AhnLab detected the campaign during a breach investigation. “The AhnLab Security Intelligence Center (ASEC) discovered a new operation related to the Kimsuky group and named it Larva-24005,” researchers said in a blog post. “The threat actors exploited the RDP vulnerability to infiltrate the (breach-affected) system.”

Kimsuky (aka APT43, Velvet Chollima, Black Banshee, and THALLIUM) is a threat group primarily known for espionage activities aligned with North Korea’s state interests. Common vectors used by this group for initial access include spear-phishing, software flaws, and social engineering.

BlueKeep was abused for initial access

During their investigation, researchers were able to find BlueKeep vulnerability scanners in the compromised system, indicating the use of the flaw for initial access. The detected scanner tools include RDPScanner CLI Type, and RDPScanner GUI Type.

However, the investigation did not reveal any evidence of BlueKeep’s actual use by the threat actors. Other methods, such as attaching malware files to emails and planting them through the Microsoft Office Equation Editor vulnerability (CVE-2017-11882) were observed, the blog noted.

“After gaining access to the system, the threat actor used a dropper to install MySpy malware and RDPWrap, and modified the system settings to allow RDP access,” researchers said.

Both MySpy and RDPWrap are legitimate Windows-based tools used for pen-testing and running concurrent remote sessions, respectively, but are popularly weaponized by threat actors for unauthorized surveillance and persistent remote access.

Apart from persistence, the Larva-24005 campaign was seen dropping, as final payloads, malware like KimaLogger and RandomQuery keyloggers.

The campaign targeted South Korea and Japan

Based on the analysis of the campaign infrastructure, threat actors have been attacking South Korea, the US, China, Japan, Germany, Singapore, South Africa, the Netherlands, Mexico, Vietnam, Belgium, the UK, Canada, Thailand, and Poland.

However, AhnLab researchers were only able to retrieve samples of phishing emails sent to South Korea and Japan. “These threat actors have been attacking South Korea’s software, energy, and financial industries since October 2023,” the researchers said.

As indicators of compromise (IOCs), the researchers shared a list of hash functions (MD5), URLs, and domain names (FQDN) that security teams can set detection alerts for.

Although buzzy for its high exploitability and impact, with CVSS 9.8 out of 10, the BlueKeep flaw has almost no exploitation history, with only one reported abuse in November 2019, months after the flaw was fixed in May, for the purpose of crypto-mining. The bigger concern, however, is the flaw gaining Kimsuky’s attention, an APT group infamous for its creative obfuscation techniques, convincing social engineering campaigns, and widespread espionage attacks.