North Korean State-Sponsored Hacking Group APT37 Stole Advertising Content From a South Korean Ad Agency to Target End Users in 2024

EuRepoC

The North Korean state-sponsored hacking group APT37 (aka "TA-Red Ant," "Red Eyes," "ScarCruft," and "Group123") launched a cyber operation against a South Korean advertising agency and ultimately against end users, exploiting a previously unknown vulnerability in Microsoft Internet Explorer (IE), support for which had ended in June 2022. The campaign took advantage of a flaw in the "Toast" advertising program. APT37 hacked into the servers of the aforementioned unnamed South Korean advertising agency, stealing ad programs and ad content and then injecting malicious code into the content, which would enable remote code execution when the ad is run on a victim's computer. These ads, which appear as pop-up notifications from the bottom right of a PC screen, need not be clicked on for the malicious code to be downloaded to a visitor's PC, according to AhnLab and the South Korean National Cyber Security Centre (NCSC)'s 16 October 2024 report. Following the discovery of the vulnerability in August 2024, AhnLab and the NCSC informed Microsoft, which distributed security patches on the vulnerability (CVE-2024-38178) in the same month.