Attacks from the online groups Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, and 10 Days of Rain are believed to have come from North Korea.
But how can we know with certainty?
And what connection does a DDoS and disk-wiping attack from July 4, 2009, have with WannaCry, one of the largest cyber attacks in the history of the cyber sphere?
From the Mydoom variant Brambul to the more recent Fallchill, WannaCry, and the targeting of cryptocurrency exchanges, we see a distinct timeline of attacks beginning from the moment North Korea entered the world stage as a significant threat actor.
Bad actors have a tendency to unwittingly leave fingerprints on their attacks, allowing researchers to connect the dots between them.
North Korean actors have left many of these clues in their wake and throughout the evolution of their malware arsenal.
This post reflects months of research; it will highlight our code analysis illustrating key similarities between samples attributed to the Democratic People's Republic of Korea (DPRK), a shared networking infrastructure, and other revealing data hidden within the binaries.
Together these puzzle pieces show the connections between the many attacks attributed to North Korea and categorize different tools used by specific teams of their cyber army.
Context
This article is too short to dig deeply into the history, politics, and economic changes of recent years. Nonetheless, we must highlight some events to put past and present cyber events into perspective.
The DPRK, like any country, wants to be as self-sufficient and independent as possible.
However, for products such as oil, food, and foreign currency for trading, the country lacks resources and has to find ways of acquiring them.
What can a nation do when legal international economics are denied?
To survive, it must gain foreign currency for trading.
One of the oldest ways to do this is to join the worlds of gambling (casinos) and drugs.
In 2005, the United States wanted to shut down North Korean enterprises involved in illegal operations.
They investigated a few banks in Asia that seemed to have ties with North Korea and operated as money laundering sites.
One bank, in particular, is controlled by a billionaire gambling mogul who started a casino in Pyongyang and has close ties to Pyongyang.
That bank, based in Macau, came back into the picture during an attack on the SWIFT financial system of a bank in Vietnam in 2015.
The Macau bank was listed twice in the malware's code as a recipient of stolen funds:
Figure 1: SWIFT code in malware.
Code reuse
There are many reasons to reuse malware code, which is common in the world of cybercrime.
For example, in an average ransomware campaign, once the campaign becomes less successful, actors often change some of the basics such as using a different packer to bypass defences.
With targeted campaigns, an adversary must keep its tools undetected for as long as possible.
By identifying reused code, we gain valuable insights about the "ancestral relations" to known threat actors or other campaigns.
Our research was heavily focused on this type of analysis.
In years of investigating cyber threats, we have seen the DPRK conduct multiple cyber campaigns.
In North Korea, hackers' skills determine which cyber units they work for.
We are aware of two major focuses of DPRK campaigns: one to raise money, and one to pursue nationalist aims.
The first workforce gathers money for the nation, even if that means committing cybercrime to hack into financial institutions, hijack gambling sessions, or sell pirated and cracked software.
Unit 180 is responsible for illegally gaining foreign currency using hacking techniques.
The second workforce operates larger campaigns motivated by nationalism, gathering intelligence from other nations, and in some cases disrupting rival states and military targets.
Most of these actions are executed by Unit 121.
We focused in our research on the larger-scale nationalism-motivated campaigns, in which we discovered many overlaps in code reuse.
We are highly confident that nation-state–sponsored groups were active in these efforts.
Timeline
We created a timeline of most of the malware samples and noticeable campaigns that we examined. We used primarily open source blogs and papers to build this timeline and used the malware artefacts as a starting point of our research.
Figure 2: Timeline of malware and campaigns.
Analysis and observations
Similarities
During our research, we found many malware family names that are believed to be associated with North Korea's cyber operations.
To better understand this threat actor and the similarities between the campaigns, we used Intezer's code similarity detection engine to plot the links between a large number of these malware families.
The following graph presents a high-level overview of these relations.
Each node represents a malware family or a hacking tool ("Brambul," "Fallchill," etc.) and each line presents a code similarity between two families.
A thicker line correlates to a stronger similarity.
In defining similarities, we take into account only unique code connections, and disregard common code or libraries.
This definition holds both for this graph and our entire research.
Figure 3: Code similarities between North Korean–associated malware families.
We can see a significant amount of code similarities between almost every one of the attacks associated with North Korea.
Our research included thousands of samples, mostly unclassified or uncategorized.
This graph was plotted using a dataset of only several hundred samples, so there may be more connections than displayed here.
More technical insights on the methodology used and a closer look at the malware code can be found on the McAfee website.
Final words
Security vendors and researchers often use different names when speaking about the same malware, group, or attack.
This habit makes it challenging to group all the malware and campaigns.
By taking a scientific approach, such as looking for code reuse, we can categorize our findings.
We believe our research will help the security community organize the current "mess" we face in relation to North Korean malware and campaigns.
We saw a lot of code reuse over the many years of cyber campaigns we examined.
This indicates the North Koreans have groups with different skills and tools that execute their focused parts of cyber operations while also working in parallel when large campaigns require a mix of skills and tools.
By combining our skills, data, and technology, we were able to draw connections and reveal links that we had not seen before.
The cybersecurity industry would benefit from more collaboration and sharing of information, and we hope that this effort between McAfee and Intezer will inspire the community to work together more often.
The authors thank Costin Raiu for providing them with samples they did not have in their collections.
