###  # Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families [By Jay Rosenberg and Christiaan Beek on Aug 09, 2018](https://securingtomorrow.mcafee.com/author/jay-rosenberg/) ## Newsletter Sign Up First Name * Last Name * ----- Attacks from the online groups Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, and 10 Days of Rain are believed to have come from North Korea. But how can we know with certainty? And what connection does a DDoS and disk-wiping attack from July 4, 2009, have with WannaCry, one of the largest cyberattacks in the history of the cyber sphere? From the Mydoom variant Brambul to the more recent Fallchill, WannaCry, and the targeting of cryptocurrency exchanges, we see a distinct timeline of attacks beginning from the moment North Korea entered the world stage as a significant threat actor. Bad actors have a tendency to unwittingly leave fingerprints on their attacks, allowing researchers to connect the dots between them. North Korean actors have left many of these clues in their wake and throughout the evolution of their malware arsenal. This post reflects months of research; in it we will highlight our code analysis illustrating key similarities between samples attributed to the Democratic People’s Republic of Korea, a shared networking infrastructure, and other revealing data hidden within the binaries. Together these puzzle pieces show the connections between the many attacks attributed to North Korea and categorize different tools used by specific teams of their cyber army. **Valuable context** This article is too short to dig deeply into the history, politics, and economic changes of recent years. Nonetheless, we must highlight some events to put past and present cyber events into perspective. |--Please Select--|Col2| |---|---| [mcafee_labs](https://www.twitter.com/mcafee_labs) ICYMI: Our team analyzed Country * Submit ## McAfee on Twitter [ Follow us on Twitter](https://twitter.com/McAfee) [mcafee_labs](https://www.twitter.com/mcafee_labs) Threat actors continue to evolve their tools, increasing complexity and functionality. Learn how these cybercrimes… [https://t.co/ibrUsYyn7V](https://t.co/ibrUsYyn7V) 21 hours ago [Reply · Retweet · Favorite](https://twitter.com/intent/tweet?in_reply_to=1028084351542747136) ----- lacks resources and has to find ways of acquiring them. What can a nation do when legal international economics are denied? To survive, it must gain foreign currency for trading. One of the oldest ways to do this is to join the worlds of gambling (casinos) and drugs. In 2005, the United States wanted to shut down North Korean enterprises involved in illegal operations. They investigated a couple of banks in Asia that seemed to have ties with North Korea and operated as money laundering sites. One bank in particular is controlled by a billionaire gambling mogul who started a casino in Pyongyang and has close ties to Pyongyang. That bank, based in Macau, came back into the picture during an attack on the SWIFT financial system of a bank in Vietnam in 2015. The Macau bank was listed twice in the malware’s code as a recipient of stolen funds: [https://t.co/FLgQ6Vn4yc](https://t.co/FLgQ6Vn4yc) 22 hours ago [Reply · Retweet · Favorite](https://twitter.com/intent/tweet?in_reply_to=1028071021235130368) [mcafee_labs](https://www.twitter.com/mcafee_labs) Bad actors are exploiting connected home devices to find new innocent targets. Which connected device do you think… [https://t.co/pxWq9B6Rqo](https://t.co/pxWq9B6Rqo) 2 days ago [Reply · Retweet · Favorite](https://twitter.com/intent/tweet?in_reply_to=1027776786061438977) ## Next Article ----- _Figure 1: SWIFT code in malware._ **Code reuse** [Consumer Threat Notices](https://securingtomorrow.mcafee.com/category/consumer/consumer-threat-notices/) 5 Tips To Protect Your IoT Devices ----- campaign becomes less successful, actors often change some of basics such as using a different packer to bypass defenses. With targeted campaigns, an adversary must keep its tools undetected for as long as possible. By identifying reused code, we gain valuable insights about the “ancestral relations” to known threat actors or other campaigns. Our research was heavily focused on this type of analysis. In our years of investigating cyber threats, we have seen the DPRK conduct multiple cyber campaigns. In North Korea, hackers’ skills determine which cyber units they work for. We are aware two major focuses of DPRK campaigns: one to raise money, and one to pursue nationalist aims. The first workforce gathers money for the nation, even if that means committing cybercrime to hack into financial institutions, hijack gambling sessions, or sell pirated and cracked software. Unit 180 is responsible for illegally gaining foreign currency using hacking techniques. The second workforce operates larger campaigns motivated by nationalism, gathering intelligence from other nations, and in some cases disrupting rival states and military targets. Most of these actions are executed by Unit 121. We focused in our research on the larger-scale nationalism-motivated campaigns, in which we discovered many overlaps in code reuse. We are highly confident that nation state–sponsored groups were active in these efforts. **Timeline** We created a timeline of most of the malware samples and noticeable campaigns that we examined. We used primarily open-source blogs and papers to build this timeline and used the malware artifacts as a starting point of our research. ----- _Figure 2: Timeline of malware and campaigns._ **Analysis and observations** Similarities During our research, we found many malware family names that are believed to be associated with North Korea’s cyber operations. To better understand this threat actor and the similarities between the campaigns, we have used Intezer’s code similarity detection engine to plot the links between a vast number of these malware families. ----- p y g similarity. In defining similarities, we take into account only unique code connections, and disregard common code or libraries. This definition holds both for this graph and our entire research. ----- ----- the attacks associated with North Korea. Our research included thousands of samples, mostly unclassified or uncategorized. This graph was plotted using a data set of only several hundred samples, so there might be more connections than displayed here. Deep technical analysis During our research, we came across many code similarities between North Korean binaries that had not been seen before. Some of these attacks and malware have not been linked to one another, at least publicly. We will showcase four examples of reused code that has been seen only in malware attributed to North Korea. 1. Common SMB module The first code example appeared in the server message block (SMB) module of WannaCry in 2017, Mydoom in 2009, Joanap, and DeltaAlfa. Further shared code across these families is an AES library from CodeProject. These attacks have been attributed to Lazarus; that means the group has reused code from at least 2009 to 2017. ----- _Figure 4: Code overlap of a Mydoom sample._ In the next screenshots we highlight the exact code block that reflects the SMB module we found in campaigns other than WannaCry and Mydoom. ----- ----- _Figure 5: An SMB module common to several attacks._ [A lot has been written about WannaCry. As we analyze the code against our databases,](https://securingtomorrow.mcafee.com/mcafee-labs/analysis-wannacry-ransomware/) we can draw the following overview: ----- _Figure 6: WannaCry code comparison overview._ For our research we compared the three major variants of WannaCry. An early release, called a beta, from February 2017, one from April, and the infamous one that hit the world in May. 2. Common file mapping The second e ample demonstrates code responsible for mapping a file and sing the ----- Korea’s Group 123. NavRAT and the gambling DLL share more code, making them closer variants. _Figure 7: Code overlap in a NavRAT sample._ ----- ----- _Figure 8: File-mapping code_ 3. Unique net share The third example, responsible for launching a cmd.exe with a net share, has been seen in 2009’s Brambul, also known as SierraBravo, as well as KorDllBot in 2011. These malware families are also attributed to the Lazarus group. _Figure 9: Code overlap of a SierraBravo (Brambul) sample._ ----- ----- _Figure 10: A code block reused in the malware families_ _Brambul/SierraBravo and KorDllBot._ 4. Operation Dark Hotel In 2014, Kaspersky reported a more than seven-year campaign against Asian hotels, in which the adversaries used an arsenal of tools to break into the computers of hotel visitors. Zero days and control servers were used, along with the malware family Tapaoux, or DarkHotel, according to the report. While we examined the DPRK samples, we noticed a hit with the Dark Hotel samples in our collections. By going through the code, we noticed several pieces of code overlap and reuse, for example, with samples from Operation Troy. ----- _Figure 11: Code overlap in a Dark Hotel sample._ Identifying a group By applying what we learned from our comparisons and code-block identifications, we uncovered possible new links between malware families and the groups using them. With the different pieces of malware we have analyzed, we can illustrate the code reuse and sharing between the groups known to be affiliated with North Korea. ----- ----- malware families spotted over the years. Lazarus is a collective name for many DPRK cyber operations, and we clearly see links between malware families used in different campaigns. The malware (NavRAT, gambling, and Gold Dragon) possibly created by Group 123 are connected to each other but are separate from those used by Lazarus. Although these are different units focusing on different areas, there seems to be a parallel structure in which they collaborate during certain campaigns. **MITRE ATT&CK** From our research of these malware samples, we can identify the following techniques used by the malware families: ----- g y g In 2018, we saw examples of campaigns in which attackers used PowerShell to download and execute these droppers. Once information has been sent to a control server, the adversary determines the next steps, which often include installing a remote access tool to enable lateral movement on the network and pursue the goals of the campaign. **Final words** Security vendors and researchers often use different names when speaking about the same malware, group, or attack. This habit makes it challenging to group all the malware and campaigns. By taking a scientific approach, such as looking for code reuse, we can categorize our findings. We believe our research will help the security community organize the current “mess” we face in relation to North Korean malware and campaigns. We clearly saw a lot of code reuse over the many years of cyber campaigns we examined. This indicates the North Koreans have groups with different skills and tools that execute their focused parts of cyber operations while also working in parallel when large campaigns require a mix of skills and tools. We found our months of research, data gathering, and analysis very satisfying. By combining our skills, data, and technology, we were able to draw connections and reveal links that we had not seen before. The cybersecurity industry would greatly benefit from more collaboration and sharing of information, and we hope that this effort between McAfee and Intezer will inspire the community to work together more often. _The authors thank Costin Raiu for providing them with samples they did not have in their_ _collections._ ----- Glenn Simpson, Gordon Fairclough, and Jay Solomon, “U.S. Probes Banks’ North Korea Ties.” Wall Street Journal, last updated September 8, 2005. Christiaan Beek, “Attacks on SWIFT Banking system benefit from insider knowledge.” https://securingtomorrow.mcafee.com/mcafee-labs/attacks-swift-banking-system benefit-insider-knowledge/ Atif Mushtaq, “DDOS Madness Continued…” https://www.fireeye.com/blog/threat research/2009/07/ddos-madness-climax.html Ryan Sherstobitoff and Jessica Saavedra-Morales, “Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems.” https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics malware-attacks-gains-permanent-presence-on-victims-systems/ Alex Drozhzhin, “Darkhotel: a spy campaign in luxury Asian hotels.” [https://www.kaspersky.com/blog/darkhotel-apt/6613/](https://www.kaspersky.com/blog/darkhotel-apt/6613/) Warren Mercer, Paul Rascagneres, and Jungsoo An, “NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea.” [https://blog.talosintelligence.com/2018/05/navrat.html](https://blog.talosintelligence.com/2018/05/navrat.html) Sergei Shevchenko and Adrian Nish, “Cyber Heist Attribution.” [https://baesystemsai.blogspot.com/2016/05/cyber-heist-attribution.html](https://baesystemsai.blogspot.com/2016/05/cyber-heist-attribution.html) Mydoom code reuse report. https://analyze.intezer.com/#/analyses/113ba80f-1680-43d7 b287-cc62f3740fad ----- SierraBravo code reuse report. https://analyze.intezer.com/#/analyses/8da8104e-56e4 49fd-ba24-82978bc1610c Dark Hotel code reuse report. https://analyze.intezer.com/#/analyses/c034e0fe-7825 4f6d-b092-7c5ee693aff4 Kang Jang-ho, “A foreign currency earned with a virtual currency … What is the life of a North Korean hacker?” http://m.mtn.co.kr/news/news_view.php? mmn_idx=2018062517065863930#_enliple Awesome work by the team responsible for the “Operation Blockbuster” [report. https://www.operationblockbuster.com/resources/](https://www.operationblockbuster.com/resources/) [ Previous Article](https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/cryptojacking-campaign-mikrotik-routers/) [Next Article ](https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/5-tips-to-protect-your-iot-devices/) [ Categories: McAfee Labs](https://securingtomorrow.mcafee.com/category/mcafee-labs/) [ Tags: advanced persistent threats, Advanced Threat Research, cybersecurity, hacking](https://securingtomorrow.mcafee.com/tag/advanced-persistent-threats/) ## Leave a reply ----- Add a comment... Facebook Comments Plugin ## Leave a Comment Comment Name * Email * Please enter an answer in digits: Post CommentPost Comment [About | Subscribe | Contact & Media Requests | Privacy Policy | Legal](https://www.mcafee.com/us/about-us.aspx) [](https://www.facebook.com/McAfee) [](https://www.youtube.com/user/McAfee) ----- Search  Back [Business](https://securingtomorrow.mcafee.com/category/business/) [Consumer](https://securingtomorrow.mcafee.com/category/consumer/) [Executive Perspectives](https://securingtomorrow.mcafee.com/category/executive-perspectives/) [McAfee Partners](https://securingtomorrow.mcafee.com/category/mcafee-partners/) [McAfee Labs](https://securingtomorrow.mcafee.com/category/mcafee-labs/) Languages English Follow us [](https://www.facebook.com/McAfee) [](https://twitter.com/McAfee) [](https://www.youtube.com/user/McAfee) [](https://plus.google.com/101523649521491717960) [](https://www.linkedin.com/company/mcafee) [](https://securingtomorrow.mcafee.com/feed/) [About](https://www.mcafee.com/us/about-us.aspx) [Subscribe](https://securingtomorrow.mcafee.com/feed/) [Contact & Media Requests](https://www.mcafee.com/us/about/contact-us.aspx#ht=tab-publicrelations) [Privacy Policy](https://www.mcafee.com/common/privacy/english/index.htm) [Legal](https://www.mcafee.com/us/about/legal/legal-notices.aspx) © McAfee LLC |English|Col2| |---|---| -----