An Advanced Persistent Threat (APT) operation, dubbed as Larva-24005, was uncovered actively exploiting critical flaws in Remote Desktop Protocol (RDP) and Microsoft Office applications to breach systems in multiple industries. The APT campaign was found to be linked to the infamous Kimsuky threat group.
The attackers mainly exploited two vulnerabilities: a critical RDP flaw (CVE-2019-0708), which allows remote code execution without authorisation, and the Microsoft Office Equation Editor vulnerability (CVE-2017-11882). After using the attack methods and gaining access, the adversaries delivered an advanced set of malware, such as MySpy and RDPWrap, to sustain the active remote access to the compromised systems.
The main targets of the attacks include the software, energy, and financial sectors of South Korea. Victims have also been identified in the United States, Japan, China, Singapore, Germany, and many other countries. ASEC analysts identified several specialised tools used by the APT group.
The findings consisted of two versions of RDP vulnerability scanners, specially crafted droppers and keyloggers developed to extract sensitive data. The threat actors, “have been sending phishing emails to South Korea and Japan,” ASEC said.
Although, certain tools were used in the attacks, many were found to be stored on affected systems without being used. The initial attack method varies according to the target. Specialised scanning tools are used in RDP-based attacks to identify vulnerable systems.
The two variants of the RDP scanner include a command-line and a graphical user interface (GUI) version. The GUI variant has extensive scanning features such as IP range specification, multi-threading options and connection timeout settings, allowing attackers to have maximum scanning efficiency. Following a successful breach, the dropper generates and runs the RDPWrap and MySpy information-gathering components.
MySpy gathers system information while RDPWrap modifies Windows system settings to allow remote connections, even on devices that would normally block the action. Access is maintained by making changes to the registry under the Windows shell startup key, allowing the tools to persist through system reboots.
In the final step, keyloggers such as KimaLogger and RandomQuery are executed to capture the user’s keyboard inputs. The campaign began in September 2023, representing a critical advancement in the threat group’s exploitation techniques, processes and tactics.
In the News: Meta expands AI-powered age verification on Instagram
