cyber.hendryadrian.com
Threat Research · kudelskisecurity.com

Research Links DPRK-Linked IT Workers to Gambling Networks and Emotet Activity

· Original article ↗

Summary

Kudelski Security researchers link stealer-log evidence, gambling operations and infrastructure to DPRK-related actors, and assess that a fake IT worker manager used IPs associated with Emotet delivery. Several attribution and location findings remain uncertain.

Key points

  • Researchers linked an actor dubbed “Bismarck” to DPRK-linked fake IT workers and found two IP addresses overlapping with indicators documented in research on the FakeCalls Android banking trojan.
  • The actor appeared to administer gambling websites and casino infrastructure. Researchers say the businesses may have been used for money laundering, but describe this as an assessment.
  • A password vault associated with a DPRK-related IT worker manager contained two IP addresses linked to Emotet delivery; researchers assess with moderate confidence that the manager used them to deploy the malware.
  • Stealer-log evidence and naming patterns led researchers to identify fake IT worker activity associated with three North Korean institutions; building and location assessments were often low confidence.
  • The report describes a DPRK fake IT worker “Base” system, including five identified bases and reported wired or SIM-router internet access; the bases’ locations are not publicly known.
  • The analysis relies on passive examination of public data, and the researchers caution that their reconstruction may be imperfect.

Article Details

Attack Vectors
  • A DPRK-linked actor nicknamed Bismarck was associated with FakeCalls Trojan indicators and gambling-operation infrastructure.
  • A DPRK-related manager's password vault contained IP addresses associated with Emotet delivery; the researchers assess with moderate confidence that the manager used them to deploy Emotet.
  • Fake IT workers were assessed to operate from university-linked teams and internal networks, including systems titled “Developer Management System” and “Student Management.”

Indicators of compromise

TypeIndicatorContext
DOMAINadmin[.]loginxcasino[.]comCasino administration domain listed among infrastructure associated with the DPRK-linked actor.
DOMAINadmin[.]moo-gadang[.]comAdministrative domain listed among gambling-operation infrastructure associated with the DPRK-linked actor.
DOMAINadminv2[.]gitslotpark[.]comAdministrative domain for a gambling site discussed in connection with the actor's gambling operation.
DOMAINapp-b[.]insvr[.]comOnline gaming and betting application domain listed among infrastructure associated with the DPRK-linked actor.
DOMAINprd-sdv2-api[.]slotsdiamond[.]comGambling-related website domain listed among infrastructure associated with the DPRK-linked actor.
DOMAINzeu-000[.]comGambling-operation domain where the DPRK-linked actor had access to the /CustomerList endpoint.
IPV4160[.]16[.]143[.]191IP address associated with Emotet delivery; researchers assess with moderate confidence that a DPRK-related manager used it to deploy Emotet.
IPV4160[.]16[.]218[.]63IP address listed in connection with Emotet; the article says it provides little additional context.
IPV4185[.]254[.]241[.]135IP address hosting an online-gaming administration interface listed with the gambling-operation infrastructure.

People

E. VasilyevichName in a lawsuit concerning copied casino games that overlaps with a name in Bismarck's autofill data; the article does not establish that this is the same person.

Threat Actors

BismarckNickname for an actor linked by the researchers to the DPRK fake IT worker environment and gambling operations; the article assesses that the actor's activity may be attributable to the DPRK.

Malware

EmotetFigure 2: Metadata session cookies DPRKtodayDPRK Fake IT Workers and Emotet Botnet ActivityFakeCallsIT workers have used this approach even within the cybercrime sector, as the first investigation into FakeCalls shows. This is why, as an analyst, I do not draw a hard line between cybercrime and state actors: the

Products

WinSCPThe credentials were stolen from the manager's WinSCP vault in 2021.

Tools

HFSpatterns documented in the previous cases. The infrastructure we reconstructed makes extensive use of an HFS solution, probably Rejetto, across PYITC teams (see Annex 2), with “Student Management” appearing as aRejettothe previous cases. The infrastructure we reconstructed makes extensive use of an HFS solution, probably Rejetto, across PYITC teams (see Annex 2), with “Student Management” appearing as a title.

Countries

JapanBased on his notes, which were written partly in Japanese and partly in Korean, this cell appears to have targeted Japan exclusively.North KoreaFollowing a recent assessment of multiple events linked to North Korea, we wanted to bring our findings together in one place. This article examines three investigations into past events that were not attributed to theRussiaIn Russia mostly and a bit CIS”South Koreadocumented by Check Point Research in its analysis of FakeCalls, an Android banking trojan targeting South Korea. Because we had already clustered this threat actor and linked him to the North Korean fake IT worker

Industries

GamblingLinking the FakeCalls Trojan to DPRK-Linked Gambling OperationsInformation Technologyat Kim Il Sung University, and PYITC, which we attribute with medium confidence to the Pyongyang Information Technology Center.

Related Articles