Operation Blockbuster revealed

Kaspersky Lab has joined industry alliance driven by Novetta to announce Operation Blockbuster. Just like the previous Operation SMN, this alliance brings together key players in the IT security industry, working together in an effort to disrupt and neutralize multiple cyberespionage campaigns that have been active for several years. Some of the targets of these campaigns included financial institutions, media houses and manufacturing companies, among others.

In the past, we published our research into the malware that was publicly attributed to the Sony Pictures (SPE) hack. Building on that data, Kaspersky Lab conducted more focused research into a cluster of related campaigns stretching back several years before the SPE incident. That cluster involves several malware families as well as campaigns that have not received media attention and were previously considered unrelated. By focusing primarily on instances of code-reuse and leveraging the power of Yara, Kaspersky researchers were able to proactively spot new malware variants produced by the same threat actor, codenamed by Novetta ‘The Lazarus Group’. For instance, past and current activity that we attribute to the Lazarus Group includes Wild Positron, which is also known publicly as Duuzer.

Some of our findings about Wild Positron and other associated operations were initially presented to a select audience at our Security Analyst Summit (SAS) in Tenerife, Spain, through a joint presentation between researchers from Kaspersky’s Global Research and Analysis Team and AlienVault Labs’ Research Team. Today, as part of Operation Blockbuster, together with Novetta and other industry partners, we are publishing our findings for the benefit of the wider public.

Technical highlights of SAS findings

The Lazarus Group’s activity spans multiple years, going back as far as 2009. However, their activity spikes starting with 2011. The group deployed multiple malware families throughout the years, including malware associated with Operation Troy and DarkSeoul, the Hangman malware (2014-2015) and Wild Positron / Duuzer (2015). The group is known for spearphishing attacks, which include CVE-2015-6585, which was a zero-day vulnerability at the time of discovery.

During our analysis of the malware from the SPE attack as well as the connected malware families mentioned above, we observed certain specific traits shared between samples used in separate attacks. In general, such similarities are instances of code sharing and indicate the existence of a relationship between the malware families, which can be used to paint a more complete picture of a threat actor. We describe some of these overlapping features below.

Network functionality

Rather than focus on the specific functionality of any given piece of malware, we focused on hunting for as many related malware as possible in order to better understand the practices of this threat actor. Studying multiple coding quirks within any given malware variant actually revealed these to be coding conventions implemented across both different malware families as well as entirely new samples. A simple example of code reuse is the networking functionality that includes a half-dozen hard-coded user-agents with the misspelling ‘Mozillar’ instead of Mozilla.

Misspelled Hardcoded User-Agent

This same user-agent appears across a variety of malware families including the original Destover as well as multiple loosely related variants of Hangman, a new campaign targeting Domain Controllers, and the Sconlog/SSPPMID samples.

Self-deleting scripts

Placeholder strings in the dropper (left) and the resulting self-delete bat file (right)

Another interesting convention is the use of BAT files to delete components of the malware after infection. These BAT files are generated on the fly and, while they serve their purpose of eliminating initial infection traces, they ironically double as a great way to identify the malware itself by honing in on the path-placeholder strings that generate the randomly-named BAT files on the infected systems. This convention is found across the widest berth of Hangman/Volgmer variants as well as a wealth of thus-far uncategorized samples from stretching from as far back as 2012/2013.

Basic anti-analysis techniques

Password-protected ZIP resource containing malware payload

A high-confidence indicator of correlation is the reuse of a shared password across malware droppers used to drop different malware variants. The droppers all kept their payloads within a password-protected ZIP under the resource name ‘MYRES’. The dropper contains the hardcoded password ‘!1234567890 dghtdhtrhgfjnui$%^^&fdt‘ making it trivially easy for an analyst to reach the payload. The purpose, of course, is not to stymie seasoned analysts but to halt automated systems from extracting and analyzing the payload.

Avid watchers

Hardcoded sandbox hostnames in latest iterations of the Lazarus Group malware

The target of this investigation is far from unaware of the efforts of security practitioners and AV vendors interested in their practices. Apart from including simple anti-analysis techniques, the Lazarus group’s latest malware now include a custom-tailored list of computer hostnames to watch out for. These hostnames belong to sandbox execution systems likely commonly executing their malware for the sake of generating detections. List of sandbox names have been made available on attacker forums or open blog posts. The interesting thing is that the Lazarus group’s list of sandbox hostnames includes the following:

These are three presumed sandbox hostnames unavailable in any public lists we’ve been able to identify. The attackers most likely collected these during the execution of their malware and decided to retaliate by adding logic to avoid execution on these systems. This displays a level of awareness of an attacker that is cognizant of the playing field and adapting to outwit their adversaries in the security industry.

Attacker activity

Profiling the PE compilation timestamps can provide security researchers with a method to identify the attacker’s activity throughout the years. This can be used to understand if the group’s efforts are increasing, decreasing or if certain blind spots exist.

Based on the analysis of several samples that we strongly associated with the group, we conclude the activity has been steadily growing since 2013.

Analysis of the working hours provide a possibly even more interesting pictures:

The group appears to start working around midnight (00 hrs GMT) and breaks for lunch around 3am GMT. Considering normal working hours, this indicates the attackers are probably located on a timezone of GMT+8 or GMT+9.

What is perhaps most surprising is the amount of sleep they get – which is roughly about 6-7 hours per night. This indicates a very hard working team, possibly more hard working than any other APT group we’ve analysed.

Language usage and attribution

Of course, one of the top questions here is who is behind the Lazarus group and is it a nation-state sponsored attacker?

Instead of speculating on the origin of these attacks, we prefer to provide technical facts and let the reader draw their own conclusions.

Out of the Lazarus group reference sample set compiled by our partner Novetta, just over 60% (61.9%) of them have at least one PE resource with Korean locale or language.

The analysis of the metadata extracted from several thousand samples shown above seems to indicate the attackers are probably located on a timezone of GMT+8 or GMT+9.

Additionally, many of the attacks in the past seemed to target institutions in South Korea, such as in the case of DarkSeoul. Coupled with the usage of a Hangul Word Processor zero-day by the attackers also seems to indicate that South Korea is one of their top interests.

Victim information

Based on KSN analysis and reports, we were able to put together a map with the most affected regions and countries by the Lazarus group malware. To create the map, we took the reference samples set from Novetta, removed the shared hacking tools (such as Process Hacker) and cross referenced them with KSN detections from the last twelve months. It should be noted that due to the large amount of samples (more than 1000), these detections can include researchers analysing the malware as well as multi-scanners or victims connecting by VPNs. Additionally, for such a large number of samples and detections, the geography can be influenced by the geographical popularity/distribution of Kaspersky Lab products; for instance, while many of the Lazarus group attacks were directed at targets in South Korea, our customer base there is relatively small and doesn’t offer a solid perspective on the infections there.

Finally, some of the malware from the Lazarus group appears to be self-spreading (worms) which affect the overall statistics if we look at it from a targeted attacks point of view.

Nevertheless, these statistics provide an overall image of Lazarus group malware detections as observed by our products over the last 12 months.

Conclusions

Our research into the Lazarus group conducted over the past several years confirms the existence of a connection between various campaigns such as Operation DarkSeoul, Operation Troy and the SPE, which we believe to be fitting under the umbrella of a single threat actor. Their focus, victimology, and guerilla-style tactics indicate a dynamic, agile and highly malicious entity, open to data destruction in addition to conventional cyberespionage operations.

During the last two years, the number of destructive attacks has grown considerably. We’ve written about some of them in our blog ‘Five Wipers in the Spotlight‘. As observed in these incidents, this kind of malware proves to be a highly effective type of cyber-weapon. The power to wipe thousands of computers at the push of a button represents a significant bounty to a CNE team tasked with disinformation and the disruption of a target enterprise. Its value as part of hybrid warfare, where wiper attacks are coupled with kinetic attacks to paralyze a country’s infrastructure remains an interesting thought experiment closer to reality than we can be comfortable with.

As we predicted, the number of wiper attacks grows steadily. It will continue to rise exponentially as media and governments respond in a way that raises the profile of the perpetrators in a politically beneficial manner. Millions of dollars in losses, disabled operational capabilities, and reputational loss will continue to haunt the victims in the wake of the Lazarus group and other actors willing to perpetrate these devastating attacks.

Together with our industry partners, we are proud to put a dent in the operations an unscrupulous actor willing to leverage these devastating techniques.

Kaspersky PR page
Novetta PR page

Indicators of Compromise (IOCs)

Novetta has put together a website with IOCs and Yara rules related to the Lazarus group. You can grab them here:

Indicators
STIX file (This file provided courtesy of CERT Australia https://www.cyber.gov.au)
YARA signatures
Large CSV of Family Hashes