Operation “STARK#MULE”

ThaiCERT Threat Group Cards

Operation “STARK#MULE” Detecting Ongoing STARK#MULE Attack Campaign Targeting Victims Using US Military Document Lures https://www.securonix.com/blog/detecting-ongoing-starkmule-attack-campaign-targeting-victims-using-us-military-document-lures/

Check Point Research

Security researchers have recently uncovered a campaign they assess might be tied to the North Korean APT37 group. In this campaign, threat actors employed counterfeit US military job-recruitment documents as bait to entice individuals into downloading malware hosted on legitimate, yet compromised Korean websites.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Securonix reveal the details STARK#MULE, a campaign carried out by attackers allegedly connected to the North Korean government, using fake U.S. military job-recruitment documents to lure people into downloading malware staged on legitimate, but compromised, South Korean e-commerce sites. [Date Occurred: -; Date Discovered: -]

UN Panel of Experts S/2024/215

Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 28 of 75, PDF p. 323). DPRK cyber actor: ScarCruft; Report Name: Detecting Ongoing STARK#MULE Attack Campaign Targeting Victims Using US Military Document Lures -Securonix; Case Summary: ScarCruft lured victims using U.S. military-related documents to run malware staged from legitimate compromised Republic of Korea websites. The goal seems to have been to spark the recipient’s curiosity enough to have them open the attached documents and inadvertently execute the contained malware.; Publication Month: July

The campaign appears to be targeting Korean-speaking victims based on the nomenclature and names of documents used, and based on the contents of the lure document.