Security company FireEye collected evidences of a cyber espionage campaign, named "Sanny", attributable to Korea. FireEye hasn't revealed the real origin of the offensive, it's a mystery which Korea is responsible between North or South Korea, but it confirmed that 80% of victims are Russian organizations and companies belonging to space research industry, information, education and telecommunication.
According Ali Islam, security researcher at FireEye declared "Though we don't have full concrete evidence, we have identified many indicators leading to Korea as a possible origin of attack."
The following are the indicators we have so far:
1. The SMTP mail server and CnC are in Korea
2. The fonts "Batang" and "KP CheongPong" used in the document are Korean
3. The fact that the attacker chose a Korean message board as the CnC shows that either he/she is a native speaker or is at least very comfortable with the Korean language
4. Some searching on "jbaksanny" (the Yahoo email used) leads to a Korean Wikipedia page created by the user named Jbaksan. The page is auto-filled and has nothing in the edit history except the creation of this user.
The unique certainly seems to be that experts have detected a state-sponsored attack and that the attackers have demonstrated great cyber capabilities.
Ali Islam added "Once you have that information, you have access to employees' emails even from outside, and that means a lot of official information," Islam says. "It also steals other accounts credentials, all user passwords stored by Firefox for auto login."
The schema of infection is classic, victims received a phishing message containing a malware hidden in a document, apparently proposing information related to a meeting of the Association of Southeast Asian Nations, that exploits a Microsoft Word vulnerability to steal data.
The figure below reports a document written with Cyrillic character set demonstrating the real targets of attacks.
The figure below reports a document written with Cyrillic character set demonstrating the real targets of attacks.
The most singular characteristic of the cyber attacks is the use of a public forum to collect the stolen information, data is sent to the board that does not require authentication mechanisms that make the victims visible.
Today the C&C server is still active and the attackers are monitoring it to check new victims and stolen data every couple of days deleting data once acquired.
Investigations are still ongoing.
