The U.S. government officials have handed security researchers at McAfee a seized server used for the 'Operation Sharpshooter', a reconnaissance campaign.
The server was said to be used by hackers to deliver a number of malware campaigns that target governments, telecommunication companies and defense contractors.
Using the said server, hackers were able to send malicious documents to targets via Dropbox. The initial attack vector contains a weaponized macro. Once downloaded, it places macro-code to download a second-stage implant, dubbed Rising Sun, which is a modular type of malware that was pieced together different components.
With this, the hackers can conduct reconnaissance and steal user data, including computer name, IP address data, native system information and more.
It was said that the server belonged to the Lazarus Group, a hacker group linked to North Korea.
Read: 'Operation Sharpshooter' Has Hit 87 Organizations In 24 Countries During October And November Alone
According to Christiaan Beek, lead scientist and senior principal engineer at McAfee:
"In having visibility into an adversary’s command-and-control server, we were able to uncover valuable information that lead to more clues to investigate."
The move by the government, was part of an effort to better understand threats from foreign countries, which included the WannaCry ransomware outbreak that happened in 2017, as well as more targeted attacks on global businesses.
After examining the Operation Sharpshooter server, the researchers at McAfee said that the codes exceeded their expectations in complexity, scope and breadth.
The sever was operational far longer than first believed - dating back to September 2017 - and targeted a broader range of industries and countries, including financial services and infrastructure in Europe, the UK and the U.S.
Acting as the command and control infrastructure for malware, the server houses codes that were written in PHP and ASP web languages, making them easy to deploy and highly scalable.
Further research concluded that the codes have several components used to launch attacks on the hackers’ targets.
According to McAfee, each component has a specific role, like for example, to implant a downloader, which hosts and pulls the implant from another downloader. There is also the command interpreter, which operates the Rising Sun implant through an intermediate hacked server to help hide the wider command structure.
“These components appear in various implants dating back to 2016, which is one indication that the attacker has access to a set of developed functionalities at their disposal,” said McAfee’s research.
The researchers also found a “clear evolutionary” path from Duuzer, a backdoor used to target South Korean computers, dating back as far as 2015. The malware codes found were realized to be at the same family of malware used in the Sony hack, also attributed to North Korea.
Although the evidence points to the Lazarus Group, evidence from the log files show a batch of IP addresses purportedly from Namibia, which researchers can’t initially explain.
“It is quite possible that these unobfuscated connections may represent the locations that the adversary is operating from or testing in,” the research said. “Equally, this could be a false flag."
Christiaan Beek continued by saying that:
"Access to the adversary’s command-and-control server code is a rare opportunity. These systems provide insights into the inner workings of cyberattack infrastructure, are typically seized by law enforcement, and are only rarely made available to private sector researchers."
