North Korean Threat Actor Deploys EarlyRat
Researchers have discovered that the threat actor known as Andariel, aligned with North Korea, utilized a previously unknown malware named EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year.
In these attacks that use EarlyRat, Andariel gains control over victim systems by exploiting Log4j, which in turn downloads additional malware from the command-and-control server.
Andariel, also known as Silent Chollima and Stonefly, is linked to North Korea's Lab 110, a primary hacking unit that houses APT38 (aka BlueNoroff) and other subordinate elements collectively referred to as the Lazarus Group.
Apart from conducting espionage against foreign governments and military entities of strategic interest, this threat actor is involved in cybercrime to generate additional income for the nation affected by sanctions.
Andariel Threat Actor Possesses Varied Arsenal
Andariel possesses various cyber weapons, including a ransomware strain known as Maui, as well as multiple remote access trojans and backdoors like Dtrack (aka Valefor and Preft), NukeSped (aka Manuscrypt), MagicRAT, and YamaBot.
NukeSped comes equipped with features for creating and terminating processes, as well as manipulating files on the infected host. The use of NukeSped overlaps with a campaign tracked by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) under the name TraderTraitor.
Previously, the weaponization of the Log4Shell vulnerability in unpatched VMware Horizon servers by Andariel was documented by AhnLab Security Emergency Response Center (ASEC) and Cisco Talos in 2022.
The latest attack chain, uncovered by researchers, reveals that EarlyRat is distributed through phishing emails containing Microsoft Word documents as decoys. Upon opening the files, recipients are prompted to enable macros, triggering the execution of VBA code responsible for downloading the trojan.
EarlyRat, described as a simple yet limited backdoor, is designed to gather and transmit system information to a remote server and execute arbitrary commands. It exhibits similarities to MagicRAT and is written using a framework called PureBasic. In contrast, MagicRAT utilizes the Qt Framework.
Another notable aspect of the intrusion is the use of legitimate off-the-shelf tools such as 3Proxy, ForkDump, NTDSDumpEx, Powerline, and PuTTY for further exploitation of the target.
