Kaspersky Securelist
IT threat evolution Q2 2019 (DPRK-related paragraph 4) · 2019-08-19
We discovered that one victim from Russia had also triggered a malware detection while staying in North Korea in the past. This target had been infected with GreezeBackdoor, a tool of the DarkHotel APT group. The victim had also been attacked using the Konni malware – malware disguised as a North Korean news item in a weaponized document called ‘Why North Korea slams South Korea’s recent defense talks with U.S-Japan.zip’. This is not the first time that we have seen an overlap of ScarCruft and DarkHotel threat actors: it is something that members of our team have discussed at security conferences and we have shared details on the overlap with our threat intelligence customers in the past. Both threat actors are Korean speaking, although they seem to have different TTPs (Tactics, Techniques and Procedures).