North Korean Hackers Target Cybersecurity Researchers with Trojanized IDA Pro

Lazarus, the North Korea-affiliated state-sponsored group, is
attempting to once again target security researchers with backdoors
and remote access trojans using a trojanized pirated version of the
popular IDA Pro reverse engineering software.

The findings were reported^[1]
by ESET security researcher Anton Cherepanov last week in a series
of tweets.

IDA Pro is an Interactive Disassembler^[2] that’s designed to
translate machine language (aka executables) into assembly
language, enabling security researchers to analyze the inner
workings of a program (malicious or otherwise) as well as function
as a debugger to detect errors.

“Attackers bundled the original IDA Pro 7.5 software developed
by [Hex-Rays] with two malicious components,” the Slovak
cybersecurity firm said, one of which is an internal module called
“win_fw.dll” that’s executed during installation of the
applications. This tampered version is then orchestrated to load a
second component named “idahelper.dll” from the IDA plugins folder
on the system.

Upon successful execution, the “idahelper.dll” binary connects
to a remote server at “www[.]devguardmap[.]org” to retrieve
subsequent payloads. The domain is also notable for the fact that
it’s been previously linked^[3]
to a similar North Korea-backed campaign aimed at security
professionals and disclosed by Google’s Threat Analysis Group
earlier this March.

The covert operation involved the adversaries setting up a fake
security company known as SecuriElite^[4]
alongside a number of social media accounts across Twitter and
LinkedIn in an attempt to trick unsuspecting researchers into
visiting the company’s malware-laced website so as to trigger an
exploit that leveraged a then zero-day in Internet Explorer
browser. Microsoft eventually addressed the issue in its Patch Tuesday update^[5]
for March 2021.

Also known by the monikers APT38, Hidden Cobra, and Zinc, the
Lazarus Group^[6]
is known to be active as early as 2009 and linked to a string^[7]
of attacks^[8]
for financial gain^[9]
and harvesting sensitive information from compromised
environments.

“North Korea’s cyber program poses a growing espionage, theft,
and attack threat,” according^[10] to the U.S. Office of
the Director of National Intelligence 2021 Annual Threat Assessment
published earlier this April.

“North Korea has conducted cyber theft against financial
institutions and cryptocurrency exchanges worldwide, potentially
stealing hundreds of millions of dollars, probably to fund
government priorities, such as its nuclear and missile
programs.”