BlueNoroff (APT38) adopts new methods for intrusion

Analysis

On 27th December 2022, Secure list published a blog on APT38 BlueNoroff group adopting new attack methodologies, the APT38 is a threat group targeting financial institutions, one of the top operations performed by the group was the Bank of Bangladesh heist, where they have stolen around 81 million as per reports.

The threat actors started to deliver malware through the image files with the extension of .iso, as they adapted to this technique to avoid MOTW (Mark of the Web), where MOTW is a code inserted into a saved copy of a web page to indicate its origin, it’s a mitigation technique introduced by Microsoft. The BlueNoroff group delivers the ISO image file containing a PowerPoint slide show and a Visual basic script.

The PowerPoint contains a malicious link, when a user clicks a link, it executes the vbs file through the Wscript process. Additionally, Secure list has observed the download and launch of a new suspicious batch file, based on the naming convention of the file, secure list suspects bluenoroff's current target would be the blockchain industry.

Prevention

• Use Antivirus or EDR in all endpoints.
• Take regular backups of end devices to reduce the impact of cyber-attacks.

Detection

Create rules based on known indicators of threat activity in the SIEM (Security incident event management) tool for detection.

MITRE ATT&CK® Techniques

Indicators of Compromise (IOCs)

References

SECURELIST by Kaspersky