North Korean Cyber Threat Groups Unleash New Malware Arsenal in 2024

On September 9, 2024, Palo Alto Networks' Unit 42 released a detailed threat assessment outlining the activities of various North Korean cyber threat groups operating under the Reconnaissance General Bureau (RGB). The report highlights how these state-sponsored groups have targeted industries across the globe, deploying custom malware across Windows, macOS, and Linux platforms. This article delves into the key findings, detailing the tools, techniques, and groups involved in recent campaigns.

Introduction

The Lazarus Group has often been used as an umbrella term for North Korean threat actors in public reports. However, the Unit 42 report clarifies that multiple distinct groups operate under the RGB, each with its specific focus, ranging from financial theft to geopolitical disruption. Some notable threat groups mentioned include:

• Alluring Pisces (APT38/Bluenoroff)
• Gleaming Pisces (Citrine Sleet)
• Jumpy Pisces (Andariel/Hidden Cobra)
• Selective Pisces (TEMP.Hermit/ZINC)
• Slow Pisces (TraderTraitor)
• Sparkling Pisces (Kimsuky)

These groups have been active for over a decade, with significant campaigns such as the Sony Pictures hack in 2014 and the WannaCry ransomware outbreak in 2017. More recently, their focus has shifted toward the cryptocurrency sector, supply chain attacks, and espionage.

Report Overview

The Unit 42 threat assessment identifies 10 distinct malware families actively used by North Korean groups, many of which target macOS, Linux, and Windows systems. Below are key examples:

1. RustBucket (macOS)
   • A backdoor malware, RustBucket uses a multi-stage infection chain that starts with an AppleScript file. The final payload, written in Rust, allows attackers to download and execute files and self-terminate the malware.
2. KANDYKORN (macOS)
   • This malware follows a five-stage infection process, starting with a malicious ZIP file. Through reflective loading, it delivers the final payload, capable of data exfiltration and arbitrary command execution.
3. SmoothOperator (macOS)
   • Deployed via a Trojanized version of the 3CX client application, SmoothOperator extracts sensitive data and executes follow-up payloads.
4. OdicLoader (Linux)
   • This downloader uses a Unicode trick to masquerade as a PDF file. It was observed in the 2023 Operation DreamJob campaign.
5. Comebacker (Windows)
   • Distributed through malicious PyPI packages, Comebacker communicates with its C2 server, allowing attackers to exfiltrate data and execute payloads.

Insights and Analysis

The activities of these North Korean groups have significant geopolitical and financial implications. By targeting cryptocurrency exchanges, defense contractors, and critical infrastructure, these actors pose a persistent and evolving threat. Their ability to adapt malware to different platforms further complicates detection and prevention efforts.

There are several key defensive measures to protect against these threat actors. Their Cortex XDR platform provides a multi-layered defense, detecting and preventing malware from groups like Alluring Pisces and Sparkling Pisces. Behavioural threat protection, combined with malware analysis and Advanced DNS Security, can help identify malicious activity before it can cause damage.

North Korean cyber actors continue to be a formidable force, with their sophisticated malware arsenal posing risks to industries worldwide. For organizations looking to improve their defences:

1. User awareness training with an emphasis on self-reporting
2. Implementing behavioral analytics to detect unusual activity patterns.
3. Deploying endpoint detection and response (EDR) solutions to prevent the execution of unknown malware.
4. Regularly updating security configurations and conducting vulnerability assessments.

Indicators of Compromise (IOC)

MITRE ATT&CK Table

References

Threat Assessment: North Korean Threat Groups

Explore Unit 42’s review of North Korean APT groups and their impact, detailing the top 10 malware and tools we’ve seen from these threat actors. Explore Unit 42’s review of North Korean APT groups and their impact, detailing the top 10 malware and tools we’ve seen from these threat actors.

Unit 42Unit 42