Higaisa - G0126

Created: 2021-03-05T18:54:56.267Z

Modified: 2021-04-22T02:12:43.892Z

Contributors: Daniyal Naeem, BT Security

Aliases

Higaisa

Description

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)

Techniques Used

Higaisa has used VBScript code on the victim's machine.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Higaisa has called various native OS APIs.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the

Higaisa used a payload that creates a hidden window.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Higaisa’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1029|Scheduled Transfer|

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|