APT trends report Q3 2023 (DPRK-related paragraph 2)

Kaspersky Securelist

While tracking the activities of the ScarCruft group, we stumbled upon a novel infection chain. It was initiated by a cleverly crafted macro-embedded Word document that posed as a commercial invoice written in Russian. Once permission is obtained to execute the embedded macro, a highly sophisticated infection chain is executed. The initial infection vector injects a relatively large first-stage shellcode, including additional packages needed for installation, into a legitimate Windows process. Once the victim’s status is verified, the shellcode proceeds to install the Windows Resource Kit, using it to establish a persistent Windows service. In addition, if Python is not present on the victim’s system, the shellcode drops the Python package to enable further infection. It then deploys the malicious Python script and the next-stage payload to the victim. This process goes through two more shellcode stages before ultimately executing the Windows executable payload without any disk involvement, deploying the well-known RokRat or BlueLight malware. The final payload uses only cloud services such as OneDrive, GoogleDrive, PCloud and BackBlaze for its C2 operations and data exfiltration. While investigating this case, we discovered that the attacker had compromised their own host for testing purposes, giving us a valuable insight into their testing environment. Moreover, our telemetry strongly suggests that the intended target of this attack was an individual or entity associated with a trading company linked to Russia and North Korea.