APT trends report Q2 2022 (DPRK-related paragraph 3)

Kaspersky Securelist

We discovered a highly active campaign, starting in March 2022, targeting stock and cryptocurrency investors in South Korea. Based on the domain naming scheme, we call this campaign NaiveCopy. The actor used cryptocurrency-related contents or complaints from law enforcement as lure themes. The infection chains involved remote template injection, spawning a malicious macro which starts a multi-stage infection procedure making use of Dropbox. Finally, after beaconing the victim’s host information, the malware attempts to fetch the final stage payload. Luckily, we had a chance to acquire the final stage payload, which consists of several modules for exfiltrating sensitive information from the victim. As a result of analyzing the final payload, we found additional samples used a year ago. At that time, the threat actor used an Excel document and Windows executable file for the initial infection vector. The final payload used in 2021 had different structures, but it had many overlaps with previous versions. Based on this finding, we confirmed that this campaign had lasted for at least a year. We worked closely with KrCERT and ISP vendors to shut down the attacker’s infrastructure, preventing additional infections. In terms of attribution, we can’t find any precise connection to known threat actors, though we do believe that they are familiar with the Korean language and utilized a similar tactic to steal the login credentials for a renowned Korean portal that has been used by the Konni group.