A spear-phishing attack operated by a North Korean threat actor
targeting its southern counterpart has been found to conceal its
malicious code within a bitmap (.BMP) image file to drop a remote
access trojan (RAT) capable of stealing sensitive information.
Attributing the attack to the Lazarus Group[1]
based on similarities to prior tactics adopted by the adversary,
researchers from Malwarebytes said the phishing campaign started by
distributing emails laced with a malicious document that it
identified on April 13.
“The actor has used a clever method to bypass security
mechanisms in which it has embedded its malicious HTA[2]
file as a compressed zlib[3]
file within a PNG file that then has been decompressed during run
time by converting itself to the BMP format,” Malwarebytes
researchers said[4].
“The dropped payload was a loader that decoded and decrypted the
second stage payload into memory. The second stage payload has the
capability to receive and execute commands/shellcode as well as
perform exfiltration and communications to a command and control
server.”
Created on March 31, 2021, the lure document (in Korean)
purports to be a participation application form for a fair in one
of the South Korean cities and prompts users to enable macros upon
opening it for the first time, only to execute the attack code that
triggers the infection chain, ultimately dropping an executable
called “AppStore.exe.”
The payload then proceeds to extract an encrypted second-stage
payload appended to itself that’s decoded and decrypted at run
time, followed by establishing communications with a remote server
to receive additional commands and transmit the results of those
commands back to the server.
“The Lazarus threat actor is one of the most active and
sophisticated North Korean threat actors that has targeted several
countries including South Korea, the U.S., and Japan in the past
couple of years,” the researchers said. “Lazarus is known to employ
new techniques and custom toolsets in its operations to increase
the effectiveness of its attacks.”