@BushidoToken Threat Intel

  Introduction The BBC World Service has recently produced The Lazarus Heist podcast (available here ), researched and presented by Geoff White and  Jean H. Lee . This thrilling podcast dives into the intracacies of the elaborate Bangladesh Bank heist attempt to steal $1 billion. As a security researcher that actively tracks the Lazarus group and any mentions of North Korean cyber activity, I found this podcast series was extremely detailed and well researched. There are so many additional info gems that anyone who has researched North Korea will enjoy. I also highly recommend it for any threat intelligence analysts investigating North Korean cyber activity.  The Lazarus Heist podcast also made me want to revisit what I have learned about North Korean advanced persistent threat (APT) groups. In February 2020, I blogged about who the Lazarus group is and what campaigns they are known for (see here ). This was one of my first blogs and I was eager to learn more while resea...

  Malicious Word doucments titled “Pyongyang stores low on foreign goods amid North Korean COVID-19 paranoia.doc” were recently uploaded to malware submission sites such as ANY.RUN, VMRay, and VirusTotal: Analysis of the Word documents revealed that a VBA macro is used to drop a secondary payload and connects the infected device to the adversary’s command and control (C&C) server. The malware used in this attack is detected as the Amadey Trojan, a commodity tool used for credential harvesting and remote control by threat actors of all skill levels. The payload is hosted on a compromised website and is retrieved by the Amadey Trojan once the malicious macros are enabled. VirusTotal campaign graph: Analysis: Commodity malware, such as the Amadey Trojan, is a concern because it does not require its operator to have any development capability, only the capacity to deploy it. This increases the number of potential attackers in the ecosystem. Furthermore, commodit...

Introducing a new remote access tool (RAT) I recently discovered: Filenames include ‘OzhSecSys.exe’ or ‘system.exe’. Interestingly, the IP address used to host the OZH RAT domain (185[.]176.43[.]94) is used in prior #Konni attack campaigns, but is not thought to be connected to the North Korean APT. #OZHRAT IOCs: https://t.co/B5KNjQBWUX — Will | BushidoToken 👁‍🗨 (@BushidoToken) May 28, 2020 Malpedia link:  https://malpedia.caad.fkie.fraunhofer.de/details/win.ozh_rat IOCs in my OTX feed for this threat have been attached  here . More info: Florian Roth's THOR APT Scanner picked it up early on: Windows Forms & System Configuration checks: OZH RAT is a new malware as far as I can tell. I would be very much interested if another security researcher is able to investigate or share samples of OZH RAT for further malware analysis. Updated - 2nd June 2020: I recently discovered the OZH RAT #crimware website, which is written in Turkish. The #malware has an exceptionally ...