Group123 is a North Korean APT group engaged in cyber espionage and ransomware operations targeting multiple countries and industries globally. Their campaigns utilize sophisticated malware, exploit recent vulnerabilities, and employ diverse TTPs to maintain persistent access and evade detection. #Group123 #APT37 #CyberEspionage
Keypoints
- Group123 has been active since at least 2012 and targets primarily East Asia, Southeast Asia, and the Middle East, including countries like South Korea, Japan, Vietnam, and the United States.
- The group uses a broad arsenal of custom and commodity malware including KARAE, PoohMilk Loader, ROKRAT, and Maui ransomware to conduct espionage and financial gain operations.
- Initial access is commonly achieved through spear phishing with malicious Office documents and exploitation of public-facing web application vulnerabilities like CVE-2018-4878 and CVE-2022-41128.
- The group employs advanced persistence and defense evasion tactics such as DLL sideloading, encrypted communications, multi-stage payloads, and using legitimate web and cloud services for C2.
- Group123 conducts credential harvesting, internal network reconnaissance, lateral movement using remote access tools, and data exfiltration to fulfill their espionage objectives.
- A notable trend includes deploying ransomware attacks alongside espionage campaigns to generate illicit revenue supporting strategic state-sponsored goals.
- The group shows rapid adaptation to emerging vulnerabilities and changes in technology to maintain operational effectiveness and stealth.
MITRE Techniques
- [T1189] Drive-by Compromise â Gaining initial access by exploiting vulnerabilities in web browsers or plugins (âDrive-by Compromises: Exploiting vulnerabilities in web browsers or plugins when users visit malicious or compromised websitesâ).
- [T1548.002] Abuse Elevation Control Mechanism: Bypass User Access Control â Used for privilege escalation to gain higher-level access (âAttempting to bypass User Account Control (UAC)â).
- [T1057] Process Discovery â Gathering information about running processes on compromised systems (âGathering information about the compromised systemâŚâ).
- [T1566.001] Spear Phishing Attachment â Delivery of malicious Office documents to gain initial access (âHighly targeted spear phishing emails, often containing malicious attachmentsâ).
- [T1055] Process Injection â Executing malicious code by injecting into other processes (âEmploying scripting and leveraging Windows API calls for executing malicious codeâ).
- [T1033] System Owner/User Discovery â Information gathering on user and system accounts (âGathering information about the compromised system, including computer name, username, execution pathâ).
- [T1053.005] Scheduled Task/Job: Scheduled Task â Used for persistence and impact (âEstablishing backdoors for continued accessâ and âPersistenceâ).
- [T1120] Peripheral Device Discovery â Reconnaissance to identify hardware (âGathering information about BIOS modelâ).
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder â Persistence method to maintain access (âModifying system configurations, such as adding entries to Registry Run Keys/Startup Foldersâ).
- [T1082] System Information Discovery â For internal reconnaissance (âGathering system information to discover networkâ).
- [T1059] Command and Scripting Interpreter â Using scripting for execution (âEmploying scripting and leveraging Windows API calls for executing malicious codeâ).
- [T1203] Exploitation for Client Execution â Using Microsoft Office exploits and Flash Exploits for execution (âCommonly exploit vulnerabilities in word processors⌠and Flash Exploitsâ).
- [T1005] Data from Local System â Collecting sensitive data locally (âCollecting sensitive data from local systemsâ).
- [T1059.003] Windows Command Shell â Executing commands on Windows systems (âUsing command shells to execute malicious commandsâ).
- [T1027] Obfuscated Files or Information â Defense evasion through encryption and layered payloads (âUsing encryptionâŚSplitting payloads into multiple stages to complicate analysisâ).
- [T1123] Audio Capture â Use of audio recording tools (âEmploying tools for specific data collection, such as audio capturing utilitiesâ).
- [T1059.006] Python â Use of Python scripts for execution or post-exploitation (âEmploying scriptingâŚâ).
- [T1204.002] User Execution: Malicious File â Executing malicious files delivered in phishing emails (âSpear phishing with malicious attachmentsâ).
- [T1027.003] Software Packing â Using packers to evade detection (âEmploying techniques like splitting payloadsâŚâ).
- [T1559.002] Inter-Process Communication â Used in C2 communications (âLeveraging legitimate services for command and control (C2)â).
- [T1036.001] Masquerading: Rename System Utilities â Techniques to evade detection (âEmploying DLL sideloading, DLL hollowing, and call stack spoofingâ).
- [T1071.001] Application Layer Protocol: Web Protocols â Using HTTPS for C2 communication (âUsing encryption, particularly HTTPS, for C2 communicationsâ).
- [T1059.005] Command and Scripting Interpreter: Visual Basic â Use of Visual Basic scripts (âEmploying scriptingâ).
- [T1102.002] Web Service â Use of compromised legitimate web servers and cloud services for command and control (âUtilizing compromised legitimate web servers or cloud-based platforms for C2 infrastructureâ).
- [T1106] Execution through API â Using Windows APIs to execute payloads (âEmploying Windows API calls for executing malicious codeâ).
- [T1094] Proxy Execution â Using proxy techniques for C2 communication (âLeveraging legitimate services for command and controlâ).
- [T1555.003] Credentials from Web Browsers â Harvesting credentials stored in browsers (âHarvesting credentials from web browsersâ).
- [T1105] Ingress Tool Transfer â Downloading additional tools after initial compromise (âEmploying custom malware and additional payloadsâ).
- [T1547.001] Boot or Logon Autostart Execution â Persistence via startup execution (âModifying system configurations for persistenceâ).
- [T1561.002] Disk Wipe â Deployment of destructive malware (âDeploying destructive malware, such as disk wipersâ).
- [T1529] System Shutdown/Reboot â Impact technique used in disruptive attacks (âConducting ransomware and destructive attacksâ).
Indicators of Compromise
- [Malware Names] Used malware in campaigns â KARAE, PoohMilk Loader, ROKRAT, HAPPYWORK, Maui ransomware.
- [CVE Identifiers] Exploited vulnerabilities â CVE-2018-4878, CVE-2022-41128.
- [File Hashes] Various malicious payload hashes related to malware families like Final1stSpy, GELCAPSULE, and RUHAPPY (âand 2 more hashesâ).
- [Domains / C2 Servers] Compromised legitimate web servers and cloud services for C2 communications (e.g., Google Drive, Yandex, Mediafire).
- [File Names] Malicious document attachments used in spear phishing campaigns exploiting Office Suite vulnerabilities (e.g., crafted HWP and Microsoft Office files).