Huntress Traces Targeted BABYSHARK Espionage to Voice of America Phishing Lure

Mar 1, 2022 · Original article ↗

Summary

Huntress reconstructed a BABYSHARK intrusion at a think tank linked to North Korean tradecraft. A fake Voice of America exchange delivered malicious Word macros, enabling persistence, C2 communications and nearly a year of undetected activity.

Key points

Huntress discovered the activity on February 16, 2022; the earliest recovered script timestamps dated to March 9, 2021. Researchers linked the activity to known North Korean tradecraft.
Attackers impersonated a Voice of America author, solicited input and returned purported edits through a OneDrive download containing a password-protected malicious Word document. The recipient forwarded the email to colleagues.
The document's macro checked for selected antivirus products, disabled Word macro protections and attempted to stage version.dll for DLL hijacking through OneDriveStandaloneUpdater.exe. Researchers could not recover that DLL.
A GoogleUpdater scheduled task launched qwert.vbs, which extracted encoded VBScript from a Google Drive filename using johnbegin and johnend delimiters. Later execution decoded and ran the saved payload.
Recovered scripts checked specific usernames, established scheduled-task and registry persistence, and retrieved commands from worldinfocontact[.]club. Enumeration output was Base64-encoded with certutil and uploaded to hodbeast[.]com.
Researchers decoded a separate RAT DLL and suggested it might be a KimJongRAT variant, but analysis was unfinished. Additional PowerShell artifacts monitored browser tabs and developer-tool use.
Antivirus did not prevent the intrusion, but retained scan logs helped correlate affected hosts and recover the phishing archive. Huntress reported that remote-access and exfiltration capabilities had remained active for nearly a year.

Article Details

Attack Vectors: The adversary impersonated a Voice of America author, solicited the victim's input, and subsequently sent a OneDrive download link under the pretext of returning edits for approval.
The downloaded VOA_Korea.zip contained a password-protected Word document with a malicious macro. The initial recipient forwarded the email to coworkers, extending the compromise.
The macro downloaded a decoy document and a payload subsequently renamed version.dll, then launched OneDriveStandaloneUpdater.exe to initiate DLL hijacking.
Scheduled tasks executed VBScript loaders that retrieved obfuscated scripts from Google Drive and executed additional code stored in the registry.
HTTP-based command-and-control infrastructure delivered commands and received encoded reconnaissance output.
A recovered script restricted further execution to selected usernames, demonstrating customization for the victim environment.
Defensive Notes: Antivirus did not prevent the intrusion, but retained scan logs helped investigators correlate files across three compromised hosts and identify the initial malicious document.
Scheduled-task persistence detection initiated the investigation; process telemetry subsequently exposed script execution and related activity.
The malicious macro checked for BitDefender and Norton Security and stopped if they were present.
The macro changed registry settings to disable Microsoft Word macro warnings and security protections.
The password-protected document impeded inspection and potentially concealed its malicious macros from antivirus scanning.
The original version.dll payload was unavailable on affected hosts and could no longer be retrieved from its hosting URL, limiting analysis.
The article emphasizes retained logs, monitoring, threat hunting, and human analysis because prevention can fail.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`beastmodser[.]club`	Malicious hosting domain used to deliver the decoy Word document and DLL-hijacking payload.
DOMAIN	`frebough[.]com`	Additional suspected C2 endpoint contacted by a script with the current username, apparently to report completion of an execution step.
DOMAIN	`hodbeast[.]com`	Staging C2 domain that supplied reconnaissance commands.
DOMAIN	`retmodul[.]com`	Accessed during normal.crp execution; the source suggests it may signal successful compromise.
DOMAIN	`worldinfocontact[.]club`	Beaconing C2 domain polled for pending commands and scripts.
SHA256	`2ad3266331e405677c68bb43c490467107ca398d3ce430080a4db92036c93160`	Hash of the certificate-formatted desktop.xml artifact containing an encoded RAT DLL.
SHA256	`5b31d65b0607ae3de40ff8376bb83f3ff4defba3b564c380be5514d9766978ea`	Hash of desktop.tmp, which stored obfuscated commands supplied by the beaconing C2.
SHA256	`bf82675bac2cd574fa8b87659217bffb29d4bc49b355b405ac4cd2666cd72f5a`	Hash of sys0.vbs, a scheduled-task loader that executed code stored in a RegisteredApplications registry value.
SHA256	`c327631a212e4a9681e3cf1574c500ce3700186cc605ae08db5878ecb0bfe66f`	Hash of a Startup-folder OneNote.vbs artifact associated with launching the PowerShell implant; the source notes that its hash may vary across machines.
SHA256	`c86d6e9dfc79bdf29f0826327992f8cf3df3e1ed6b41f1c8f6ee67b32bef3a6b`	Hash of r.vbs, which terminated OneDrive, deleted the adjacent version.dll, and restarted OneDrive.
SHA256	`d41c943fd5ffacde74f487df6a43b72e9730f05812b9b1f8dc874bd486f182b3`	Hash of pow.ps1, a recovered script that appeared to remove Google Chrome security preferences.
SHA256	`def0975728fc5da61c022bb62b7160e2764631b852ec7f83951263c7830bec8d`	Hash of dev.ps1, an implant script using inline C# to track browser tabs and monitor Browser Developer Tools usage.
SHA256	`e08fe0b287b4d112514276c2b102b9c80b4dab73257f06ab24231329389ad931`	Hash of qwert.vbs, the scheduled VBScript loader that retrieved encoded script content from a Google Drive filename.
SHA256	`e314b40449b7b9b84f20f49f89888511433573377e007e5c1e94fd84ecf17caf`	Hash of the RAT DLL decoded from desktop.xml; its possible relationship to KimJongRAT remained unconfirmed.
URL	`hxxp[:]//beastmodser[.]club/sil/0304/VOA_Korea[.]docx`	Decoy Word document download URL invoked by the malicious macro to reinforce the phishing pretext.
URL	`hxxps[:]//beastmodser[.]club/sil/0304/d[.]php?na=version.gif`	Payload download URL used by the macro to obtain version.tmp, subsequently renamed version.dll for DLL hijacking.
URL	`hxxps[:]//hodbeast[.]com/silver/upload[.]php`	Exfiltration endpoint receiving Base64-encoded reconnaissance output through an HTTP POST request.