APT trends report Q3 2021 (DPRK-related paragraph 5)

Kaspersky Securelist

Back in May, we published a report about the freshly discovered activity of Andariel. In this campaign, a broad spectrum of industries located in South Korea were targeted with custom ransomware. During our research, we discovered that the actor was using two vectors to compromise targets. The first was the use of weaponized Microsoft Office documents with malicious macros. At the time of our original report, the second vector was still unknown but we discovered artifacts containing the path of the tool ezPDF Reader, developed by a South Korean software company named Unidocs. We were missing clear evidence that the attack leveraged a vulnerability within this software, and to solve this mystery we decided to audit the binary of this application. Our analysis of the software led us to discover a remote code execution vulnerability in ezpdfwslauncher.exe that can be leveraged to break into computers on the network with ezPDF Reader without any user interaction. We assess with high confidence that the Andariel group used the same vulnerability in its attacks. After this discovery, we contacted the developers of Unidocs and shared the details of this vulnerability with them. It was fixed as CVE-2021-26605.