North Korean Hackers Launch Attack Using Windows Update And Github

The state-sponsored organization, already suspected in past attacks such as WannaCry and numerous attacks against U.S media outlets, was discovered using Windows Update to deliver malicious payloads while using GitHub as a primary command and control (C2) server. The attacks loosely followed the group’s earlier dream job campaign, which targeted organizations as well as specific individuals in the defense, aerospace, and civilian government contracting sectors. The spear phishing attack used two decoy MS Word documents with embedded macros (Lockheed_Martin_JobOpportunities.docx and Salary_Lockheed_Martin_job_opportunities_confidential.doc) that were designed to appear as valid Lockheed Martin job announcement information. Once the malicious macros are executed by an unsuspecting user, the malware package completes a series of injections on the target system to ensure persistence across target machine startups. A complete description of the attack process, as well as an in-depth discussion of the individual components making up the attack, are available on the Malwarebytes Lab Threat Intelligence Team’s blog. Malwarebytes researchers and security engineers attributed the attack to Lazarus based on similarities to past attacks by the North Korean organization, such as:

Well-designed fraudulent job opportunity documents branded with icons for defense contractors such as Lockheed Martin, Northrop Grumman, and Boeing Specific targeting of job seekers in the defense and aerospace sectors Similarities in metadata that link the recent spear phishing campaign with similar past campaigns

An April 2020 Cyber Threat Advisory was released by the DHS Cybersecurity and Infrastructure Security Agency (CISA) to provide formal guidance regarding North Korea’s cyber activity. The State Department’s Rewards for Justice (RFJ) program also provides guidance on what types of information and activity should be reported. Qualifying tips that disrupt any actions against the U.S. government are eligible for rewards of up to $5 million dollars.