North Korean state-integrated threat actor Lazarus leveraged zero day against South Korean Software maker Dream Security to setup supply-chain-compromise in March 2023 · 01.03.2023
In a joint advisory from 23 November 2023, South Korea's National Intelligence Service (NIS) and the UK National Cyber Security Centre (NCSC) provided details for the exploitation of a zero-day vulnerability in the authentication solution MagicLine4NX of South Korean company Dream Security by North Korean state-linked actors. The South Korean cybersecurity firm AhnLab, which first disclosed the threat activity on 13 October, associated the operation with the Lazarus group. The joint advisory outlines a layered supply chain attack dating back to March 2023. Lazarus is believed to have initiated the compromise by planting a malicious script in articles of a news website, turning the reports into watering holes. The script activates for connections from a specific band of IPs designated by the threat actors. Lazarus subsequently leveraged vulnerabilities in MagcLine4NX running on systems of visitors of the media site to move laterally to connected Internet-facing networks of the victim. For at least one unidentified organisation, the advisory observed the threat actors were in a position to exfiltrate a large volume of internal data only prevented by a security policy that stopped communications with a command-and-control server.
Warning for MagicLine4NX (Certificate Solution) Vulnerability and Update Recommended · 2023-03-21
excerpt: Vulnerable Software and Overview MagicLine4NX is a non-ActiveX joint certificate program developed by the Korean company, Dream Security. Users can use MagicLine4NX to perform logins with a joint certificate and digitally sign transactions. This program is registered as a Startup Program and will be relaunched by a certain service (MagicLine4NXServices.exe) even if it is […] | attribution sentence: Patch Target and Versions MagicLine4NX versions 1.0.0.1-1.0.0.26 Vulnerability Exploitation Log (Lazarus) AhnLab’s ASD (AhnLab Smart Defense) infrastructure confirmed the exploitation of this vulnerability. | target sentence: Patch Target and Versions MagicLine4NX versions 1.0.0.1-1.0.0.26 Vulnerability Exploitation Log (Lazarus) AhnLab’s ASD (AhnLab Smart Defense) infrastructure confirmed the exploitation of this vulnerability.
공인 인증 솔루션(MagicLine4NX) 취약점 주의 및 업데이트 권고 · 2023-03-21
excerpt: 취약 소프트웨어 및 개요 MagicLine4NX는 국내 드림시큐리티사에서 제작한 Non-ActiveX 공동인증서 프로그램이다. 사용자는 MagicLine4NX 프로그램을 이용하여 공동인증서 로그인과 거래내역에 대한 전자서명을 할 수 있다. 이 프로그램은 시작 프로그램에 등록되어 있으며, 프로세스가 종료되더라도 특정 서비스(MagicLine4NXServices.exe)에 의하여 재실행되며, 한번 설치되면 프로세스에 항상 상주해 있으므로 취약점 공격에 노출될 수 있다. 따라서 최신 버전으로 업데이트가 필요하다. 취약점 설명 해당 취약점은 […] | attribution sentence: 패치 대상 및 버전 MagicLine4NX 1.0.0.1~1.0.0.26 버전 취약점 악용 로그(Lazarus) 자사 ASD(AhnLab Smart Defense) 인프라를 통해 취약점을 악용한 사실이 확인되었다.