North Korean Hackers Used ‘Torisma’ Spyware in Job Offers-based Attacks

A cyberespionage campaign aimed at aerospace and defense sectors
in order to install data gathering implants on victims’ machines
for purposes of surveillance and data exfiltration may have been
more sophisticated than previously thought.

The attacks, which targeted IP-addresses belonging to internet
service providers (ISPs) in Australia, Israel, Russia, and defense
contractors based in Russia and India, involved a previously
undiscovered spyware tool called Torisma to stealthily
monitor its victims for continued exploitation.

Tracked under the codename of “Operation North Star^[1]” by McAfee researchers,
initial findings into the campaign in July revealed the use of
social media sites, spear-phishing, and weaponized documents with
fake job offers to trick employees working in the defense sector to
gain a foothold on their organizations’ networks.

The attacks have been attributed to infrastructure and TTPs
(Techniques, Tactics, and Procedures) previously associated with
Hidden Cobra^[2]
— an umbrella term used by the US government to describe all North
Korean state-sponsored hacking groups.

The development continues the trend of North Korea, a heavily
sanctioned country, leveraging its arsenal of threat actors to
support and fund its nuclear weapons program by perpetrating
malicious attacks on US defense and aerospace contractors.

While the initial analysis suggested the implants were intended
to gather basic victim information so as to assess their value, the
latest investigation into Operation North Star exhibits a “degree
of technical innovation” designed to remain hidden on compromised
systems.

Not only did the campaign use legitimate job recruitment content
from popular US defense contractor websites to lure targeted
victims into opening malicious spear-phishing email attachments,
the attackers compromised and used genuine websites in the US and
Italy — an auction house, a printing company, and an IT training
firm — to host their command-and-control (C2) capabilities.

“Using these domains to conduct C2 operations likely allowed
them to bypass some organizations’ security measures because most
organizations do not block trusted websites,” McAfee^[3]
researchers Christiaan Beek and Ryan Sherstibitoff said.

What’s more, the first-stage implant embedded in the Word
documents would go on to evaluate the victim system data (date, IP
Address, User-Agent, etc.) by cross-checking with a predetermined
list of target IP addresses to install a second implant called
Torisma, all the while minimizing the risk of detection and
discovery.

This specialized monitoring implant is used to execute custom
shellcode, in addition to actively monitoring for new drives added
to the system as well as remote desktop connections.

“This campaign was interesting in that there was a particular
list of targets of interest, and that list was verified before the
decision was made to send a second implant, either 32 or 64 bits,
for further and in-depth monitoring,” the researchers said.

“Progress of the implants sent by the C2 was monitored and
written in a log file that gave the adversary an overview of which
victims were successfully infiltrated and could be monitored
further.”