ASEC analyzes Andariel’s recent activity in Korea, linking Go-based backdoors such as Innorix Agent abuse, Goat RAT, TigerRat, NukeSped, AndarLoader, and DurianBeacon to past campaigns and possible Lazarus affiliation. The post highlights Go-language malware trends, SSL/TLS and HTTP-based C2, and delivery methods like spear phishing and supply-chain abuse, urging vigilance and prompt patching. hashtags: #Andariel #Lazarus #DurianBeacon #GoatRAT #TigerRat #NukeSped #AndarLoader #InnorixAgent #Kimsuky #GoLang
Keypoints
- The Andariel threat group has historically targeted Korean corporations, universities, and national-security sectors, with ties to Lazarus.
- Initial access commonly involves spear phishing, watering hole attacks, and supply chain compromises, including abuse of central management solutions.
- Many Go-language backdoors are used, such as Innorix Agent abuse, NukeSped variants (Volgmer), Andardoor, 1th Troy Reverse Shell, Goat RAT, Black RAT, TigerRat, and DurianBeacon (Go and Rust).
- Recent attacks show Innorix Agent abuse leading to direct malware deployment (e.g., Goat RAT) and shared C2 infrastructure with other Go-based backdoors.
- DurianBeacon exists in Go and Rust versions, uses SSL (and XOR in Rust), and supports information gathering, file operations, and command execution via C2.
- The report links past and current campaigns through pattern similarities (paths, file names, C2 URLs) to argue a single actor behind multiple incidents in Korea.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – The Andariel campaign historically uses spear phishing to distribute malware; “During the initial compromise stage, the Andariel threat group usually employs spear phishing, watering hole, and supply chain attacks.”
- [T1189] Watering Hole – Indicated as part of initial access techniques alongside spear phishing. “During the initial compromise stage, the Andariel threat group usually employs spear phishing, watering hole, and supply chain attacks.”
- [T1195] Supply Chain Compromise – Mentioned as part of initial access methods. “…spear phishing, watering hole, and supply chain attacks.”
- [T1027] Obfuscated/Compressed Files and Information – Obfuscation of and/or Dotfuscator usage for AndarLoader; “obfuscated with the Dotfuscator tool.”
- [T1218.005] Signed Binary Proxy Execution: Mshta – Use of mshta.exe to install TigerRat; “Mshta process installing TigerRat”
- [T1059.003] Windows Command Shell – Goat RAT and other Go backdoors show commands like “cmd /c tasklist” and “cmd /c ipconfig /all”
- [T1059.001] PowerShell – AndarLoader delivered via PowerShell; “installed via PowerShell”
- [T1071.001] Web Protocols – C2 communications use HTTP/HTTPS; “uses the HTTP protocol to communicate with the C&C server” and SSL in various variants
- [T1573] Encrypted Channel – SSL-based C2 communications in DurianBeacon Go version; “SSL encryption to communicate with the C&C server”
- [T1133] External Remote Services – Ngrok used for RDP connections during attacks; “Ngrok was installed for RDP connection during the attack process”
- [T1003.001] Credential Dumping – Mimikatz installed on infected systems; “installing Mimikatz in the infected system”
- [T1555.003] Credentials in Web Browsers – Infostealer in past attacks targeted browser-stored credentials; “steals account credentials saved in Internet Explorer, Chrome, and Firefox”
Indicators of Compromise
- [IP] – Example: 27.102.113[.]88, 109.248.150[.]179 – C2 servers used by NukeSped/Volgmer and related backdoors
- [Domain] – kro.kr, chinesekungfu[.]org – Domains referenced for C2/downloads
- [MD5] – 0a09b7f2317b3d5f057180be6b6d0755, 1ffccc23fef2964e9b1747098c19d956 – used by NukeSped variant – Volgmer
- [MD5] – 9112efb49cae021abebd3e9a564e6ca4 – another NukeSped variant
- [File Path] – E:/Projects/Malware/6_Goat_23/Goat/Goat.go, I:/01___Tools/02__RAT/Black/Client_Go/Client.go – source paths showing Go-based Goats/RAT development
- [File Name] – iexplorer.exe, authsvc.exe – names used to install malware via Innorix Agent/Andariel campaigns
- [URL] – hxxp://27.102.113[.]88/client.exe, hxxp://www.ipservice.kro[.]kr/dataSeq.exe – download/install/update URLs
- [Registry Key] – HKLMSYSTEMCurrentControlSetControlWMISecurity – registry artifact involved in some variants
Read more: https://asec.ahnlab.com/en/56405/