DPRK-Linked Actors Use GitHub for C2 in Multi-Stage Attacks on South Korea
Summary
Fortinet reports that likely DPRK-linked actors use phishing-delivered LNK files and PowerShell to target South Korean organizations, exfiltrating host profiles to a GitHub repository and retrieving further modules for C2.
Key points
- Fortinet says likely DPRK-linked actors use phishing-delivered Windows LNK files to start attacks against South Korean organizations, displaying a decoy PDF while malicious scripts run.
- The PowerShell payload checks for virtual-machine, debugger, and forensic processes and terminates if it detects them.
- The script extracts a VBScript and creates a scheduled task that runs the PowerShell payload every 30 minutes in a hidden window.
- The compromised host’s profile is sent to a GitHub repository using a hard-coded access token; the script also retrieves additional modules or instructions from the repository.
- Related Kimsuky activity described in the article uses Dropbox C2 and delivers a Python backdoor; the downloaded ZIP fragments come from quickstor[.]store.
- The article also notes ScarCruft’s use of an HWP OLE dropper and DLL side-loading to deliver RokRAT, according to S2W.
Article Details
- Event Type
- DPRK-linked cyber campaigns targeting South Korean organizations, including attacks using GitHub and Dropbox as command-and-control channels.
- Impact
- The reported attack chains can establish persistence, exfiltrate compromised-host profiles, retrieve additional payloads or instructions, and enable remote command execution and file operations. No specific affected organizations or confirmed victim count are disclosed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | quickcon[.]store | Remote server reported to host ZIP fragments downloaded as part of a malicious infection chain. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe attack uses obfuscated Windows LNK files.T1053.005 · Scheduled TaskA scheduled task launches the PowerShell payload every 30 minutes and after reboot.T1057 · Process DiscoveryThe PowerShell script checks running processes related to virtual machines, debuggers, and forensic tools.T1059.001 · PowerShellPowerShell scripts execute payloads and perform host profiling and other attack-chain actions.T1102.002 · Bidirectional CommunicationGitHub is used for ongoing command-and-control, including retrieving additional modules or instructions.T1105 · Ingress Tool TransferThe attack retrieves additional modules and downloads ZIP fragments and other payloads.T1497.001 · System ChecksThe script terminates if it detects processes associated with virtual machines, debuggers, or forensic tools.T1566.001 · Spearphishing AttachmentLNK files are assessed to have been distributed through phishing emails.T1567.001 · Exfiltration to Code RepositoryHost profiles are exfiltrated to a GitHub repository, which is also used to retrieve modules or instructions.
People
Threat Actors
Malware
MoonPeakRelated campaigns have deployed Xeno RAT, MoonPeak, and RokRAT via alternate droppers and C2 channels (Dropbox, remote servers), favoring native Windows tools to evade detection.RokRATRelated campaigns have deployed Xeno RAT, MoonPeak, and RokRAT via alternate droppers and C2 channels (Dropbox, remote servers), favoring native Windows tools to evade detection.XenoRATRelated campaigns have deployed Xeno RAT, MoonPeak, and RokRAT via alternate droppers and C2 channels (Dropbox, remote servers), favoring native Windows tools to evade detection.
Products
Dropbox DocSendRelated campaigns have deployed Xeno RAT, MoonPeak, and RokRAT via alternate droppers and C2 channels (Dropbox, remote servers), favoring native Windows tools to evade detection.GitHubanti-analysis checks, establishes persistence via scheduled tasks, exfiltrates host profiles to a GitHub repository (motoralis) using a hard-coded token, and fetches additional modules from the same repo toHangul Word Processor“C:windirr” path to stage the payloads, including a decoy PDF and another LNK file that mimics a Hangul Word Processor (HWP) document.