Malware News US-North Korea Summit News Used as Lure In New Malware Campaign

LASER_oneXM

Level 37
Thread author
Verified
Top Poster
Well-known
Feb 4, 2016
2,520
Previously known threat actor Group 123 likely behind NavRAT malware, security vendor says.

North Korea's Group 123, an advanced persistent threat actor responsible for several major malicious campaigns in recent years, is believed to be behind new malware activity targeting users in South Korea.


Researchers at Cisco Talos say the group has launched a spear-phishing campaign in which a document purporting to be about the planned June summit between President Trump and North Korean leader Kim Jong-Un is being used as a lure for downloading malware.


The decoy document is a Hangul Word Processor (HWP) document titled "Prospects for US-North Korea Summit." It contains an Encapsulated PostScript (EPS) object designed to download and execute a remote access Trojan that Talos has dubbed NavRAT. The Trojan is downloaded from a legitimate Korean website that appears to have been compromised and used to host the malware.


NavRAT does all the standard things that a remote access Trojan can be used for, including keylogging, downloading, uploading, and executing malicious commands on the compromised systems. What makes the malware interesting is the manner in which it communicates with the command-and-control infrastructure.
 
  • Like
Reactions: harlan4096

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top