Unnamed advertising agency in South Korea · 16/10/2024
Researchers at AhnLab and the National Cyber Security Center (NCSC) of the Republic of Korea, discover Operation Code on Toast, a malicious campaign targeting an unnamed advertising agency in South Korea
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) · 2024-10-16
excerpt: AhnLab SEcurity intelligence Center (ASEC) and the National Cyber Security Center (NCSC) have discovered a new zero-day vulnerability in the Microsoft Internet Explorer (IE) browser and have conducted a detailed analysis on attacks that exploit this vulnerability. This post shares the joint analysis report “Operation Code on Toast by TA-RedAnt” which details the findings of […] | attribution sentence: This post shares the joint analysis report “Operation Code on Toast by TA-RedAnt” which details the findings of the ASEC and NCSC joint analysis and the responses to the threat. | target sentence: They have previously targeted specific individuals such as North Korean defectors and experts in North Korean affairs using hacking emails, Android app package file (.apk), and IE vulnerabilities.
안랩과 국가사이버안보센터(NCSC), 합동 보고서 배포 및 Microsoft 브라우저 0-DAY 발견 (CVE-2024-38178) · 2024-10-16
excerpt: 안랩 ASEC(AhnLab SEcurity intelligence Center) 분석팀과 국가사이버안보센터(NCSC, National Cyber Security Center, 이하 ‘NCSC’ ) 합동분석협의체에서 Microsoft Internet Explorer(이하 ‘IE’) 브라우저의 새로운 제로데이를 발견하고, 해당 취약점을 이용한 공격을 상세 분석하였다. 본 게시글을 통해 ASEC과 NCSC 합동분석협의체에서 함께 분석하고 대응한 내용을 담은 합동 분석 보고서(‘Operation Code on Toast by TA-RedAnt‘)를 공개한다. 이번 오퍼레이션의 배후는 북한의 […] | attribution sentence: 본 게시글을 통해 ASEC과 NCSC 합동분석협의체에서 함께 분석하고 대응한 내용을 담은 합동 분석 보고서(‘ Operation Code on Toast by TA-RedAnt ‘)를 공개한다. | target sentence: (별칭: RedEyes, ScarCruft, Group123, APT37 등) 이들은 과거 북한 관련 인물들을 대상으로 해킹 메일, 모바일 앱(APK), IE 취약점 등을 이용해 공격한 사례가 있다.
Unmasking CVE-2024-38178: The Silent Threat of Windows Scripting Engine · 2024-10-16
attribution sentence: CVE-2022-41128 is publicly available with detailed analysis and was exploited by a threat group behind North Korea in 2022, so it is likely that attackers quickly weaponized the vulnerability. | target sentence: An attacker exploiting this vulnerability can remotely execute code on a targeted Windows system.
“Operation Code on Toast”: IE zero-day via pop-up “toast ads” against ROK national security officials and DPRK-related NGOs (RokRAT) · May 2024
(MSMT/2025/2, report p. 95) “In May 2024, APT37 carried out a large-scale cyber operation targeting ROK national security officials and representatives of DPRK-related non-governmental organizations in the ROK by exploiting vulnerabilities in pop-up ads (commonly referred to as “toast ads”) embedded in various free software. APT37 exploited zero-day vulnerabilities in the Internet Explorer browser engine ... APT37 managed to install a Remote Access Trojan (dubbed “RokRAT”) on infected computers” (footnote 314: National Cyber Security Center and AhnLab, “Operation Code on Toast,” November 2024)