Previously known threat actor Group 123 likely behind NavRAT malware, security vendor says.
North Korea's Group 123, an advanced persistent threat actor responsible for several major malicious campaigns in recent years, is believed to be behind new malware activity targeting users in South Korea.
Researchers at Cisco Talos say the group has launched a spear-phishing campaign in which a document purporting to be about the planned June summit between President Trump and North Korean leader Kim Jong-Un is being used as a lure for downloading malware.
The decoy document is a Hangul Word Processor (HWP) document titled "Prospects for US-North Korea Summit." It contains an Encapsulated PostScript (EPS) object designed to download and execute a remote access Trojan that Talos has dubbed NavRAT. The Trojan is downloaded from a legitimate Korean website that appears to have been compromised and used to host the malware.
NavRAT does all the standard things that a remote access Trojan can be used for, including keylogging, downloading, uploading, and executing malicious commands on the compromised systems. What makes the malware interesting is the manner in which it communicates with the command-and-control infrastructure.