이 보고서는 러시아 원자력 발전소를 대상으로 해킹을 시도하는 스피어 피싱 메일에서 사용된 악성코드에 대한 분석 보고서이다. 러시아를 대상으로 활동하는 것으로 판단되는 해킹 그룹은 2018년에도 러시아의 원자력 발전소를 포함한 여러 산업군들 대상으로 한 해킹 활동이 발견된 적이 있다. 본 보고서에서는 이번 해킹 활동 뿐 아니라, 2018년 발견된 해킹 활동을 포함하여 해당 해킹 그룹의 특징과 악성코드 동작 방식에 대해 다룬다.
At the end of 2019, a hacking activity of SectorJ17 group targeting manufacturing and other industrial facilities in South Korea was found.
The SectorJ17 group is a cybercrime hacking group aimed at earning monetary profit. They have been active since 2014 until now and more active activities have been found since 2018.
The worldwide epidemic of Corona virus (COVID-19) affects more than 1.2 million people in 212 countries. For the APT group, which mainly uses social engineering techniques as the initial infection, the Corona virus is a good topic to attract the attention of targets.
A total of 7 subgroups of SectorA have been found to date. In 2019, the activities of the SectorA01 group were most prominent, followed by the activities of the SectorA05 and SectorA02 groups. SectorA groups conduct hacking activities to collect political and diplomatic information related to specific country or to earn foreign currency.
A total of 11 subgroups of SectorC have been found to date. In 2019, the activities of the SectorC01 group were most prominent, followed by the activities of the SectorC08 and SectorC02 groups. SectorC groups conduct extensive hacking activities around the world, and their activities are mainly found in SectorC’s neighboring countries.
At the end of October, a person deeply involved in the pro-democracy side of the Hong Kong protests received a spear phishing email from someone claiming to be a law student at a top foreign university, requesting for feedback on his supposed thesis which includes recommendations on how to end the Hong Kong unrest. The email contained a link to a Google drive ZIP file.
Multiple organizations in Kuwait have been targeted since 2018 by a threat actor we track as SectorD01, whose primary targets appear to be located in the Middle East but also observed by us to target North America, Europe, South Asia and East Asia in other campaigns. In this analysis we will briefly go through some of the tools used by this threat actor in the campaign which are named Sakabota, Diezen, Gon, Hisoka, Netero, and EYE, and explain how these tools are linked to each other and to other activity in the region.
“Hagga” is the username of a Pastebin account used since December last year by a pervasive known group of threat actors which targets thousands of users around the world both for cyber espionage and cyber crime purposes using malspam. Their activities were first discovered in 2017, and the ThreatRecon Team tracks both this group and the members behind “Hagga” collectively as the SectorH01 group.
SectorJ04 is a Russian-based cybercrime group that began operating about five years ago and conducted hacking activities for financial profit using malware such as banking trojans and ransomware against national and industrial sectors located across Europe, North America and West Africa.
From March to July this year, the ThreatRecon team noticed a spear phishing campaign by the SectorE02 group going on against the Government of Pakistan and organizations there related to defense and intelligence. Spear phishing emails are sent to their victims via Excel XLS files, which asks their victims to enable macros which will end up executing the downloader.