APT trends report Q2 2023 (DPRK-related paragraph 4)

Kaspersky Securelist

We discovered a recent BlueNoroff campaign that implements new malware delivery methods using Trojanized PDF readers, targeting both Windows and macOS systems using the same infection method. It appears that the actor distributed the Trojanized PDF reader along with a specially crafted PDF file. The malware is designed to execute only when the victim opens the malicious PDF file. Once opened, the PDF reader retrieves the offset of the decoy PDF document and the C2 URL from the PDF file. Our research has shown that the decoy documents used in this attack are related to venture capital and investigative reports from government agencies. Once the malware successfully retrieves this information, it sends the victim’s data to the remote server and initiates the execution of additional payloads delivered from the attacker’s servers. This is the first time thay BlueNoroff group has implemented macOS malware. Moreover, the group utilized compiled AppleScript during the initial stage of the attack, while the malware retrieved by the Trojanized PDF reader was created using the Rust programming language. This is the first time the BlueNoroff group has used Rust for its malware. As the target environment is diverse, the BlueNoroff group has employed additional programming languages and methodologies to efficiently deliver its malware.