Article Content This blog post is authored by Warren Mercer and Paul Rascagneres and with contributions from Jungsoo An.A one year review of campaigns performed by an actor with multiple campaigns mainly linked to South Korean targets.Executive SummaryThis article exposes the malicious activities of Group 123 during 2017 We assess with high confidence that Group 123 was responsible for the following six campaigns:"Golden Time" campaign."Evil New Year" campaign This campaign copies the approach of the 2017 "Evil New Year" campaign.The links between the different campaigns include shared code and compiler artifacts such as PDB (Program DataBase) patterns which were present throughout these campaigns.Based on our analysis, the "Golden Time", both "Evil New Year" and the "North Korean Human Rights" campaigns specifically targeted South Korean users Group 123 has been known to use exploits (such as CVE-2013-0808) or scripting languages harnessing OLE objects The purpose of the malicious documents was to install and to execute ROKRAT, a remote administration tool (RAT) On occasion the attackers directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes: the document only contained a downloader designed to download ROKRAT from a compromised web server.Additionally, the "FreeMilk" campaign targeted several non-Korean financial institutions In this campaign, the attackers made use of a malicious Microsoft Office document, a deviation from their normal use of Hancom documents Group 123 used this vulnerability less than one month after its public disclosure During this campaign, the attackers used 2 different malicious binaries: PoohMilk and Freenki PoohMilk exists only to launch Freenki This malware was used in several campaigns in 2016 and has some code overlap with ROKRAT.Finally, we identified a 6th campaign that is also linked to Group 123 We named this 6th campaign "Are You Happy?" In this campaign, the attackers deployed a disk wiper The purpose of this attack was not only to gain access to the remote infected systems but to also wipe the first sectors of the device We identified that the wiper is a ROKRAT module.This actor was very active this year and continued to mainly focus on South Korea The group leveraged spear phishing campaigns and malicious documents the contents of which included very specific language suggesting that they were crafted by native Korean speakers rather than through the use of translation services To use HTTPS communications to make it harder to perform traffic analysis.To compromise third parties to forge realistic spear phishing campaigns (i.e Yonsei university in the "Golden Time" campaign) To constantly evolve, the new fileless capability included in 2018 is a proof.The TimelineHere is the timeline for 2017 and the beginning of 2018: August 2016 to March 2017: "Golden Time" CampaignAs with the majority of Group 123 campaigns, the initial attack vector during this campaign was spear phishing Talos identified two different kinds of emails The first email we discovered was the most interesting In this sample, we observed the attackers praising the user for joining a panel related to the "Korean Reunification and North Korean Conference" The text in the email explained that the recipient should complete the attached document to provide necessary feedback This appears to be a non-existent conference The closest match we identified related to any Unification conference was held in January 2017, which was the NYDA Reunification conference The sender was 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum, a separate conference We believe that the email address was compromised and abused by the attackers to send the email used in this campaign The filename for the malicious attachment translates as 'Unification North Korea Conference _ Examination Documents' which reinforces the text in the email about the reunification conference For an added bonus, in the body of the email, the attacker even suggests that people who completed the document would get paid a 'small fee' Perhaps the gift of embedded malware is the payment:Much less effort was used to craft the second email Talos analyzed The email was from a free Korean mail service provided by Daum, Hanmail, indicating that there was no attempt to try to appear as if it originated from an official body or person, unlike the previous email described The subject was simply 'Request Help' while the attachment filename was 'I'm a munchon person in Gangwon-do, North Korea' This vulnerability targets the EPS (Encapsulated PostScript) format The purpose of the shellcode is to download a payload from the Internet If Windows XP is detected, the malware executes an infinite loop The purpose is to generate empty reports if opened on sandbox systems running Windows XP machines If it detects the presence of these tools, the malware performs two network requests to legitimate websites:hxxps://www[.]amazon[.]com/Men-War-PC/dp/B001QZGVEC/EsoftTeam/watchcom.jpghxxp://www[.]hulu[.]com/watch/559035/episode3.mp4The Amazon URL displays a WWII game called 'Men of War' while the Hulu URL attempts to stream a Japanese anime show called 'Golden Time':One of the identifying characteristics of ROKRAT is the fact that it uses social network and cloud platforms to communicate with the attackers These platforms are used to exfiltrate documents and receive instructions In this campaign the actors tried to fool victims by pretending the emails were from the Korean Ministry of Unification and that they offered Korean-specific analysis Group123 further attempted to entice victims to open the attachments by using common Hancom Hangul documents Hancom's Hangul is a popular Office Suite used primarily in the Korean peninsula The use of Hangul office documents has the advantage of being the norm for the Korean peninsula If the attacker used Microsoft documents, it may have raised suspicions in the victim This is a simple choice for the actor to make, but it further shows their familiarity with the region The document claimed to discuss the New Year's activities of North Korea and this would have been something that the victims in South Korea would be very interested in This would have been particularly true for Government targets, who we believe to be Group123's target of choice This document was well written and further increases our confidence that we are dealing with a new Korean actor The shellcode is embedded within the resource 'BIN' and is used to unpack another PE32 binary and use wscript.exe to execute it To do this, Group123 uses a well-known technique that harnesses VirtualAllocEx(), WriteProcessMemory() and CreateRemoteThread() Windows API calls.The new PE32 unpacked from the shellcode is an initial reconnaissance malware which is used to communicate with the C2 infrastructure to obtain the final payload Further network analysis showed that the binary attempted to connect to the following URLs:www[.]kgls[.]or[.]kr/news2/news_dir/index.phpwww[.]kgls[.]or[.]kr/news2/news_dir/02BC6B26_put.jpgKorean Government Legal Services (KGLS) is a legitimate Korean government body that manages Korean government legal affairs By compromising the KGLS, the attacker gained a trusted platform from which to execute an attack.The initial network connection is to 'index.php' This connection transmits the information gathered during the reconnaissance phase The attacker uses this information to then determine the specific filename (based on the random ID) to serve to the infected victim In our case this was 02BC6B26 - this meant a file "02BC6B26_put.jpg" was created for us on the attackers C2 This file is then dropped and renamed 'officepatch.exe' on the victim's machine Because the attacker was careful about who they attacked, we were unable to obtain this file during our analysis.During our investigation we were able to identify additional Command and Control infrastructure used by this actor Four C2s were observed, based in the following countries:3 C2 in South Korea1 C2 in the NetherlandsHere is a global map of the identified infrastructure:Contrary to the previous campaign, the attackers separated the reconnaissance phase from the main ROKRAT payload This trick was likely used to avoid detection This is an interesting adaptation in Group 123's behavior.March 2017: "Are You Happy?" CampaignIn March 2017, Group 123 compiled a disk wiper The malware contains 1 function, the purpose is to open the drive of the infected system (\\.\PhysicalDrive0) and write the following data to the MBR:You can see the "Are you Happy?" string in the written buffer After writing to the MBR, the malware reboots the machine with the following command: c:\windows\system32\shutdown /r /t 1After the reboot, the MBR displays the following string to the user:The link to the other campaigns was the following PDB path:D:\HighSchool\version 13\VC2008(Version15)\T+M\T+M\TMProject\Release\ErasePartition.pdbAs you can see, it perfectly matches the ROKRAT PDB This wiper is a ROKRAT module named ERSP.enc We assume that ERSP means ERaSePartition This module can be downloaded and executed on demand by Group 123.This sample is interesting considering the attack in December 2014 against a Korean power plant where the message that was displayed by the wiper was "Who Am I?".May 2017: "FreeMilk" CampaignThis campaign targeted non-Korean financial institutions, but unlike the other campaigns, this one does not use HWP documents It instead uses Office documents The file is executed with the argument: "help" At the next reboot, the malware will be executed.The second action is to check if the file "wsatra.tmp" exists in the temporary directory of the current user This sample can be executed with 3 different arguments:"Help": the value configured by PoohMilk The file is a fake image starting with "PNGF".November 2017: "North Korean Human Rights" CampaignIn November 2017, Talos observed the latest Group123 campaign of the year, which included a new version of ROKRAT being used in the latest wave of attacks Group 123 again used one of their main calling cards, the malicious HWP document This time, Group 123 used a document containing information in relation to a meeting held on 1st November in Seoul, South Korea This document was alleged to have been written by a legal representative claiming to be representing the "Citizens' Alliance For North Korean Human Rights And Reunification Of Korean Peninsula" Group 123 once again uses information related to the Korean unification and now are claiming to highlight concerns related to human rights issues Following on with the normal Group 123 activity the document was written in perfect Korean text and dialect again suggesting the origin of this group is from the Korean peninsula.Further analysis of the document text allowed us to understand the context The document mentions 'Community of North Korean human rights and unification' with the lawyer claiming to be part of the "Citizen's Alliance for North Korean Human Rights and North-South unification" The main purpose of this document was an attempt to arrange a meeting to discuss items related to "North Korean Human Rights Act" and "Enactment of a Law" which was passed in 2016 in South Korea We believe that the document was attempting to target stakeholders within the '올인통' community in an attempt to entice them to join the discussion in an attempt to work on additional ideas related to these activities The meeting was due to take place on November 1, 2017 and this document was trying to garner additional interest prior to the meeting.Once again Group 123 leveraged the use of OLE objects within the HWP document Using base64 encoding the decoded binary is stored as HncModuleUpdate.exe and is then executed This is the ROKRAT dropper Talos suspect the filename may have been selected to make it appear within running processes as a potential Hancom updater.The dropper is used to extract a new resource named SBS This specific resource contains malicious shellcode used by the malware One of Group 123 oddities in this campaign was to drop the following picture as a decoy image to the user This image shows various publicly available images which look to be related to the Korean 'Independence Movement' and appear to be related to the Korean war.We began performing further in-depth analysis on this new version of ROKRAT and this is where we started to notice some similarities with Group 123s "Evil New Years" campaign The similitudes are discussed later in this paper.This ROKRAT variant contained anti-sandbox techniques But this opcode is not correctly supported by some debugging tools, Immunity Debugger for example, will replace the assembly by "???" in red making it difficult to attempt to debug.This version of ROKRAT came with a Browser Stealer mechanism which was similar, with a few modifications, to that used in the FreeMilk campaign using Freenki malware in 2016.Group 123 continued their use of Cloud platforms with this campaign, this time leveraging pCloud, Dropbox, Box and Yandex.Finally here is the PDB of the sample used during this campaign: d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdbJanuary 2018: "Evil New Year 2018" CampaignAs we observed at the beginning of 2017, Group 123 started a campaign corresponding with the new year in 2018 This campaign started on the 2nd of January The infection vector was a malicious HWP document:This decoy document is an analysis of the 2018 New Year speech made by the leader of North Korea The approach is exactly the same as what was seen in 2017 using a new decoy document This image contains shellcode used to decode the embedded final payload: ROKRAT This ROKRAT variant is loaded from memory It's a fileless version of ROKRAT This behavior shows that Group 123 is constantly evolving to avoid detection As usual, the ROKRAT sample uses cloud providers to communicate with the operator, this time leveraging Yandex, pCloud, Dropbox and Box.Links Between CampaignsCode SharingTalos has identified that Group 123 shares code between different malware Several features are shared in the samples mentioned in this article; however we will cover only two in this article: the reconnaissance phase and the browsers stealer.Reconnaissance PhaseThe ROKRAT samples used during the two "Evil New Year" and the "North Korean Human Rights" campaigns contained a reconnaissance phase In the "Evil New Year" campaign the payload was split into two parts, the first part contained the reconnaissance code In the other campaign the reconnaissance phase was directly included in the main payload This code is the same The malware uses the following registry key to get the machine type: HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData The "System manufacturer" value is used to identify the type of machine The code appears to be based on a forum post (rohitab.com) describing the use of the Win32 APIs used The code used to perform this task in the same that found within in a Freenki sample deployed in 2016.The malware is able to extract the stored passwords from Internet Explorer, Chrome and Firefox For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password:Additionally, they support the Microsoft Vault mechanism Here is the initialization of the Vault APIs:On the left, we have the ROKRAT sample and on the right the FreeMilk sample In a specific campaign, this actor took time to compromise multiple legitimate Korean platforms including Yonsei and the KGLS in order to forge the spear phishing campaign or to host the command and control This approach is not common with less advanced actors and demonstrates a high level of maturity and knowledge of the Korean region.However Group 123's activities are not limited to South Korea For international targets, they are able to switch to a more standard attack vector such as using Microsoft Office documents as opposed to the specific HWP documents used when targeting victims located in Korea Group 123 does not hesitate to use public exploits and scripting languages to drop and execute malicious payloads We can notice that this group uses compromised legitimate websites (mainly Wordpress) and cloud platforms to communicate with the infected systems This approach makes it difficult to detect communications through analysis of these network flows In addition to the Remote Administration Tools, we identified a wiper We conclude that this group was involved in a campaign of intelligence gathering and finally attempted destruction.With our current knowledge of this actor, we predict that they will not disappear anytime soon and will continue to be active during the coming years Group 123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content This blog post is authored by Warren Mercer and Paul Rascagneres and with contributions from Jungsoo An.A one year review of campaigns performed by an actor with multiple campaigns mainly linked to South Korean targets.Executive SummaryThis article exposes the malicious activities of Group 123 during 2017 We assess with high confidence that Group 123 was responsible for the following six campaigns:"Golden Time" campaign."Evil New Year" campaign This campaign copies the approach of the 2017 "Evil New Year" campaign.The links between the different campaigns include shared code and compiler artifacts such as PDB (Program DataBase) patterns which were present throughout these campaigns.Based on our analysis, the "Golden Time", both "Evil New Year" and the "North Korean Human Rights" campaigns specifically targeted South Korean users Group 123 has been known to use exploits (such as CVE-2013-0808) or scripting languages harnessing OLE objects The purpose of the malicious documents was to install and to execute ROKRAT, a remote administration tool (RAT) On occasion the attackers directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes: the document only contained a downloader designed to download ROKRAT from a compromised web server.Additionally, the "FreeMilk" campaign targeted several non-Korean financial institutions In this campaign, the attackers made use of a malicious Microsoft Office document, a deviation from their normal use of Hancom documents Group 123 used this vulnerability less than one month after its public disclosure During this campaign, the attackers used 2 different malicious binaries: PoohMilk and Freenki PoohMilk exists only to launch Freenki This malware was used in several campaigns in 2016 and has some code overlap with ROKRAT.Finally, we identified a 6th campaign that is also linked to Group 123 We named this 6th campaign "Are You Happy?" In this campaign, the attackers deployed a disk wiper The purpose of this attack was not only to gain access to the remote infected systems but to also wipe the first sectors of the device We identified that the wiper is a ROKRAT module.This actor was very active this year and continued to mainly focus on South Korea The group leveraged spear phishing campaigns and malicious documents the contents of which included very specific language suggesting that they were crafted by native Korean speakers rather than through the use of translation services To use HTTPS communications to make it harder to perform traffic analysis.To compromise third parties to forge realistic spear phishing campaigns (i.e Yonsei university in the "Golden Time" campaign) To constantly evolve, the new fileless capability included in 2018 is a proof.The TimelineHere is the timeline for 2017 and the beginning of 2018: August 2016 to March 2017: "Golden Time" CampaignAs with the majority of Group 123 campaigns, the initial attack vector during this campaign was spear phishing Talos identified two different kinds of emails The first email we discovered was the most interesting In this sample, we observed the attackers praising the user for joining a panel related to the "Korean Reunification and North Korean Conference" The text in the email explained that the recipient should complete the attached document to provide necessary feedback This appears to be a non-existent conference The closest match we identified related to any Unification conference was held in January 2017, which was the NYDA Reunification conference The sender was 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum, a separate conference We believe that the email address was compromised and abused by the attackers to send the email used in this campaign The filename for the malicious attachment translates as 'Unification North Korea Conference _ Examination Documents' which reinforces the text in the email about the reunification conference For an added bonus, in the body of the email, the attacker even suggests that people who completed the document would get paid a 'small fee' Perhaps the gift of embedded malware is the payment:Much less effort was used to craft the second email Talos analyzed The email was from a free Korean mail service provided by Daum, Hanmail, indicating that there was no attempt to try to appear as if it originated from an official body or person, unlike the previous email described The subject was simply 'Request Help' while the attachment filename was 'I'm a munchon person in Gangwon-do, North Korea' This vulnerability targets the EPS (Encapsulated PostScript) format The purpose of the shellcode is to download a payload from the Internet If Windows XP is detected, the malware executes an infinite loop The purpose is to generate empty reports if opened on sandbox systems running Windows XP machines If it detects the presence of these tools, the malware performs two network requests to legitimate websites:hxxps://www[.]amazon[.]com/Men-War-PC/dp/B001QZGVEC/EsoftTeam/watchcom.jpghxxp://www[.]hulu[.]com/watch/559035/episode3.mp4The Amazon URL displays a WWII game called 'Men of War' while the Hulu URL attempts to stream a Japanese anime show called 'Golden Time':One of the identifying characteristics of ROKRAT is the fact that it uses social network and cloud platforms to communicate with the attackers These platforms are used to exfiltrate documents and receive instructions In this campaign the actors tried to fool victims by pretending the emails were from the Korean Ministry of Unification and that they offered Korean-specific analysis Group123 further attempted to entice victims to open the attachments by using common Hancom Hangul documents Hancom's Hangul is a popular Office Suite used primarily in the Korean peninsula The use of Hangul office documents has the advantage of being the norm for the Korean peninsula If the attacker used Microsoft documents, it may have raised suspicions in the victim This is a simple choice for the actor to make, but it further shows their familiarity with the region The document claimed to discuss the New Year's activities of North Korea and this would have been something that the victims in South Korea would be very interested in This would have been particularly true for Government targets, who we believe to be Group123's target of choice This document was well written and further increases our confidence that we are dealing with a new Korean actor The shellcode is embedded within the resource 'BIN' and is used to unpack another PE32 binary and use wscript.exe to execute it To do this, Group123 uses a well-known technique that harnesses VirtualAllocEx(), WriteProcessMemory() and CreateRemoteThread() Windows API calls.The new PE32 unpacked from the shellcode is an initial reconnaissance malware which is used to communicate with the C2 infrastructure to obtain the final payload Further network analysis showed that the binary attempted to connect to the following URLs:www[.]kgls[.]or[.]kr/news2/news_dir/index.phpwww[.]kgls[.]or[.]kr/news2/news_dir/02BC6B26_put.jpgKorean Government Legal Services (KGLS) is a legitimate Korean government body that manages Korean government legal affairs By compromising the KGLS, the attacker gained a trusted platform from which to execute an attack.The initial network connection is to 'index.php' This connection transmits the information gathered during the reconnaissance phase The attacker uses this information to then determine the specific filename (based on the random ID) to serve to the infected victim In our case this was 02BC6B26 - this meant a file "02BC6B26_put.jpg" was created for us on the attackers C2 This file is then dropped and renamed 'officepatch.exe' on the victim's machine Because the attacker was careful about who they attacked, we were unable to obtain this file during our analysis.During our investigation we were able to identify additional Command and Control infrastructure used by this actor Four C2s were observed, based in the following countries:3 C2 in South Korea1 C2 in the NetherlandsHere is a global map of the identified infrastructure:Contrary to the previous campaign, the attackers separated the reconnaissance phase from the main ROKRAT payload This trick was likely used to avoid detection This is an interesting adaptation in Group 123's behavior.March 2017: "Are You Happy?" CampaignIn March 2017, Group 123 compiled a disk wiper The malware contains 1 function, the purpose is to open the drive of the infected system (\\.\PhysicalDrive0) and write the following data to the MBR:You can see the "Are you Happy?" string in the written buffer After writing to the MBR, the malware reboots the machine with the following command: c:\windows\system32\shutdown /r /t 1After the reboot, the MBR displays the following string to the user:The link to the other campaigns was the following PDB path:D:\HighSchool\version 13\VC2008(Version15)\T+M\T+M\TMProject\Release\ErasePartition.pdbAs you can see, it perfectly matches the ROKRAT PDB This wiper is a ROKRAT module named ERSP.enc We assume that ERSP means ERaSePartition This module can be downloaded and executed on demand by Group 123.This sample is interesting considering the attack in December 2014 against a Korean power plant where the message that was displayed by the wiper was "Who Am I?".May 2017: "FreeMilk" CampaignThis campaign targeted non-Korean financial institutions, but unlike the other campaigns, this one does not use HWP documents It instead uses Office documents The file is executed with the argument: "help" At the next reboot, the malware will be executed.The second action is to check if the file "wsatra.tmp" exists in the temporary directory of the current user This sample can be executed with 3 different arguments:"Help": the value configured by PoohMilk The file is a fake image starting with "PNGF".November 2017: "North Korean Human Rights" CampaignIn November 2017, Talos observed the latest Group123 campaign of the year, which included a new version of ROKRAT being used in the latest wave of attacks Group 123 again used one of their main calling cards, the malicious HWP document This time, Group 123 used a document containing information in relation to a meeting held on 1st November in Seoul, South Korea This document was alleged to have been written by a legal representative claiming to be representing the "Citizens' Alliance For North Korean Human Rights And Reunification Of Korean Peninsula" Group 123 once again uses information related to the Korean unification and now are claiming to highlight concerns related to human rights issues Following on with the normal Group 123 activity the document was written in perfect Korean text and dialect again suggesting the origin of this group is from the Korean peninsula.Further analysis of the document text allowed us to understand the context The document mentions 'Community of North Korean human rights and unification' with the lawyer claiming to be part of the "Citizen's Alliance for North Korean Human Rights and North-South unification" The main purpose of this document was an attempt to arrange a meeting to discuss items related to "North Korean Human Rights Act" and "Enactment of a Law" which was passed in 2016 in South Korea We believe that the document was attempting to target stakeholders within the '올인통' community in an attempt to entice them to join the discussion in an attempt to work on additional ideas related to these activities The meeting was due to take place on November 1, 2017 and this document was trying to garner additional interest prior to the meeting.Once again Group 123 leveraged the use of OLE objects within the HWP document Using base64 encoding the decoded binary is stored as HncModuleUpdate.exe and is then executed This is the ROKRAT dropper Talos suspect the filename may have been selected to make it appear within running processes as a potential Hancom updater.The dropper is used to extract a new resource named SBS This specific resource contains malicious shellcode used by the malware One of Group 123 oddities in this campaign was to drop the following picture as a decoy image to the user This image shows various publicly available images which look to be related to the Korean 'Independence Movement' and appear to be related to the Korean war.We began performing further in-depth analysis on this new version of ROKRAT and this is where we started to notice some similarities with Group 123s "Evil New Years" campaign The similitudes are discussed later in this paper.This ROKRAT variant contained anti-sandbox techniques But this opcode is not correctly supported by some debugging tools, Immunity Debugger for example, will replace the assembly by "???" in red making it difficult to attempt to debug.This version of ROKRAT came with a Browser Stealer mechanism which was similar, with a few modifications, to that used in the FreeMilk campaign using Freenki malware in 2016.Group 123 continued their use of Cloud platforms with this campaign, this time leveraging pCloud, Dropbox, Box and Yandex.Finally here is the PDB of the sample used during this campaign: d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdbJanuary 2018: "Evil New Year 2018" CampaignAs we observed at the beginning of 2017, Group 123 started a campaign corresponding with the new year in 2018 This campaign started on the 2nd of January The infection vector was a malicious HWP document:This decoy document is an analysis of the 2018 New Year speech made by the leader of North Korea The approach is exactly the same as what was seen in 2017 using a new decoy document This image contains shellcode used to decode the embedded final payload: ROKRAT This ROKRAT variant is loaded from memory It's a fileless version of ROKRAT This behavior shows that Group 123 is constantly evolving to avoid detection As usual, the ROKRAT sample uses cloud providers to communicate with the operator, this time leveraging Yandex, pCloud, Dropbox and Box.Links Between CampaignsCode SharingTalos has identified that Group 123 shares code between different malware Several features are shared in the samples mentioned in this article; however we will cover only two in this article: the reconnaissance phase and the browsers stealer.Reconnaissance PhaseThe ROKRAT samples used during the two "Evil New Year" and the "North Korean Human Rights" campaigns contained a reconnaissance phase In the "Evil New Year" campaign the payload was split into two parts, the first part contained the reconnaissance code In the other campaign the reconnaissance phase was directly included in the main payload This code is the same The malware uses the following registry key to get the machine type: HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData The "System manufacturer" value is used to identify the type of machine The code appears to be based on a forum post (rohitab.com) describing the use of the Win32 APIs used The code used to perform this task in the same that found within in a Freenki sample deployed in 2016.The malware is able to extract the stored passwords from Internet Explorer, Chrome and Firefox For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password:Additionally, they support the Microsoft Vault mechanism Here is the initialization of the Vault APIs:On the left, we have the ROKRAT sample and on the right the FreeMilk sample In a specific campaign, this actor took time to compromise multiple legitimate Korean platforms including Yonsei and the KGLS in order to forge the spear phishing campaign or to host the command and control This approach is not common with less advanced actors and demonstrates a high level of maturity and knowledge of the Korean region.However Group 123's activities are not limited to South Korea For international targets, they are able to switch to a more standard attack vector such as using Microsoft Office documents as opposed to the specific HWP documents used when targeting victims located in Korea Group 123 does not hesitate to use public exploits and scripting languages to drop and execute malicious payloads We can notice that this group uses compromised legitimate websites (mainly Wordpress) and cloud platforms to communicate with the infected systems This approach makes it difficult to detect communications through analysis of these network flows In addition to the Remote Administration Tools, we identified a wiper We conclude that this group was involved in a campaign of intelligence gathering and finally attempted destruction.With our current knowledge of this actor, we predict that they will not disappear anytime soon and will continue to be active during the coming years Group 123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates ### Response: .