1
00:00:06,779 --> 00:00:09,420
yeah hi everyone first of all thank you

2
00:00:09,420 --> 00:00:11,519
for having me Defcon blue team Village

3
00:00:11,519 --> 00:00:13,679
team and thank you for joining my

4
00:00:13,679 --> 00:00:16,020
presentations and most of all most of

5
00:00:16,020 --> 00:00:18,720
the security researchers would like to

6
00:00:18,720 --> 00:00:20,939
share their great finding and excellent

7
00:00:20,939 --> 00:00:22,619
achievement through the security

8
00:00:22,619 --> 00:00:25,680
conference but in this talk I would like

9
00:00:25,680 --> 00:00:28,320
to share my failure in the threat

10
00:00:28,320 --> 00:00:31,099
intelligence industry so the title is

11
00:00:31,099 --> 00:00:33,840
attribution and bias by terrible

12
00:00:33,840 --> 00:00:35,460
mistakes in Israel intelligence

13
00:00:35,460 --> 00:00:36,719
attributions

14
00:00:36,719 --> 00:00:39,719
then let's start

15
00:00:39,719 --> 00:00:43,079
yeah before moving on allow me to

16
00:00:43,079 --> 00:00:45,539
introduce myself briefly my name is

17
00:00:45,539 --> 00:00:47,700
Susan Spa from South Korea and I'm

18
00:00:47,700 --> 00:00:50,399
working in Kaspersky great Global

19
00:00:50,399 --> 00:00:52,860
Research and Analysis team as a lead

20
00:00:52,860 --> 00:00:55,620
security researcher and I'm the only one

21
00:00:55,620 --> 00:00:58,020
who can speak the Korean in our team so

22
00:00:58,020 --> 00:01:01,140
I'm usually tracking the Korean speaking

23
00:01:01,140 --> 00:01:04,080
student actors such as the Lazarus and

24
00:01:04,080 --> 00:01:06,840
blue note of kimski duck hotel and

25
00:01:06,840 --> 00:01:09,680
scarcraft

26
00:01:10,040 --> 00:01:14,760
and yeah I believe the attendees of this

27
00:01:14,760 --> 00:01:17,280
conference already knew about what is

28
00:01:17,280 --> 00:01:18,600
the certain intelligence and

29
00:01:18,600 --> 00:01:21,659
attributions but for the people who are

30
00:01:21,659 --> 00:01:24,299
not familiar with them let me introduce

31
00:01:24,299 --> 00:01:25,680
them briefly

32
00:01:25,680 --> 00:01:27,960
the thread intelligence where the cyber

33
00:01:27,960 --> 00:01:29,640
security intelligence is a kind of

34
00:01:29,640 --> 00:01:32,400
information gathered from various

35
00:01:32,400 --> 00:01:35,880
resources and about current where the

36
00:01:35,880 --> 00:01:38,460
potential Cyber attack against the

37
00:01:38,460 --> 00:01:42,000
organizations or individuals and I think

38
00:01:42,000 --> 00:01:44,540
the key point of intelligence is

39
00:01:44,540 --> 00:01:47,820
evidence-based and the actionable advice

40
00:01:47,820 --> 00:01:49,979
Australian intelligence researcher like

41
00:01:49,979 --> 00:01:52,680
me produce the actionable items to

42
00:01:52,680 --> 00:01:55,860
respond the Cyber attack with with much

43
00:01:55,860 --> 00:01:57,659
information

44
00:01:57,659 --> 00:02:00,659
and simply the attribution is the

45
00:02:00,659 --> 00:02:03,119
process to rebuild the foods behind the

46
00:02:03,119 --> 00:02:06,719
Cyber attack so it could be specific

47
00:02:06,719 --> 00:02:09,780
groups or individuals or countries as

48
00:02:09,780 --> 00:02:12,020
well

49
00:02:12,599 --> 00:02:15,000
then let's start to talk about my

50
00:02:15,000 --> 00:02:17,520
terrible failure experience in student

51
00:02:17,520 --> 00:02:19,800
intelligence industry the first case was

52
00:02:19,800 --> 00:02:23,700
caused by my perception of bias

53
00:02:23,700 --> 00:02:27,300
and maybe you already know about the

54
00:02:27,300 --> 00:02:29,220
Olympic distributorial Target

55
00:02:29,220 --> 00:02:32,519
the pyeongchang Winter Olympics and it

56
00:02:32,519 --> 00:02:36,660
happened on February 8 2018 8 PM the

57
00:02:36,660 --> 00:02:39,900
local time the exact same time the

58
00:02:39,900 --> 00:02:42,480
Winter Olympic opening ceremony began

59
00:02:42,480 --> 00:02:45,420
and this sabotage attack accompanied

60
00:02:45,420 --> 00:02:48,840
White Memorial so it made a lot of

61
00:02:48,840 --> 00:02:51,060
damage to the Olympic Committee and

62
00:02:51,060 --> 00:02:53,220
according to the Olympic Committee more

63
00:02:53,220 --> 00:02:57,420
than 300 servers was were affected and

64
00:02:57,420 --> 00:02:59,700
many critical Services were suspended

65
00:02:59,700 --> 00:03:03,540
including the Wi-Fi and email transports

66
00:03:03,540 --> 00:03:06,060
and accommodations because of this

67
00:03:06,060 --> 00:03:09,840
reputation history or 10.

68
00:03:09,840 --> 00:03:12,560
you know Olympic Destroyer is one mobile

69
00:03:12,560 --> 00:03:15,599
that spreads itself with destruction

70
00:03:15,599 --> 00:03:18,120
capability it consists of four

71
00:03:18,120 --> 00:03:20,400
components the window credential scaler

72
00:03:20,400 --> 00:03:23,700
browser credential Stellar PSE exists

73
00:03:23,700 --> 00:03:26,040
tool for lateral movements and the wiper

74
00:03:26,040 --> 00:03:28,319
malware or system destruction

75
00:03:28,319 --> 00:03:30,299
and you can see that the other

76
00:03:30,299 --> 00:03:32,099
components are based on the public

77
00:03:32,099 --> 00:03:35,099
source code such as a mini cuts

78
00:03:35,099 --> 00:03:38,280
the only module that can be used for The

79
00:03:38,280 --> 00:03:40,319
Binding could similarity with the other

80
00:03:40,319 --> 00:03:43,739
malware was the wiper model so a lot of

81
00:03:43,739 --> 00:03:47,040
vendors start to dig into this wiper

82
00:03:47,040 --> 00:03:49,340
malware

83
00:03:49,500 --> 00:03:52,319
and in the early stage of Olympics only

84
00:03:52,319 --> 00:03:54,599
stage of Olympic history research Main

85
00:03:54,599 --> 00:03:57,900
Event there was confused uh who is

86
00:03:57,900 --> 00:04:00,060
behind the this attention one Bender

87
00:04:00,060 --> 00:04:01,319
said

88
00:04:01,319 --> 00:04:04,860
it is related to the napatia or dark web

89
00:04:04,860 --> 00:04:07,439
in instance and the other vendors urge

90
00:04:07,439 --> 00:04:09,720
that it was the letters and another

91
00:04:09,720 --> 00:04:11,879
vendor said the chinese-speaking actor

92
00:04:11,879 --> 00:04:13,920
was behind the disotech

93
00:04:13,920 --> 00:04:17,279
and I also started to look into this

94
00:04:17,279 --> 00:04:19,500
model and at the beginning of this

95
00:04:19,500 --> 00:04:23,100
research I had some bias and

96
00:04:23,100 --> 00:04:25,800
historically letters were blue North

97
00:04:25,800 --> 00:04:28,500
grew conducted a sabotage attack with

98
00:04:28,500 --> 00:04:32,520
the wiper malware so I think this case

99
00:04:32,520 --> 00:04:35,520
could be associated with these groups as

100
00:04:35,520 --> 00:04:37,620
well we don't know if you want blue

101
00:04:37,620 --> 00:04:39,120
ledgers

102
00:04:39,120 --> 00:04:41,820
and with this biased perception I start

103
00:04:41,820 --> 00:04:44,820
to find the evidence to fit into my own

104
00:04:44,820 --> 00:04:47,400
conclusion and first of all the file

105
00:04:47,400 --> 00:04:50,639
name of Olympics two you used has some

106
00:04:50,639 --> 00:04:52,860
similarity with the balloon of verb used

107
00:04:52,860 --> 00:04:53,759
before

108
00:04:53,759 --> 00:04:55,740
you can see the Olympic District used

109
00:04:55,740 --> 00:04:59,639
the evtc HK type text divide and

110
00:04:59,639 --> 00:05:01,860
previously The Blue Notes group used a

111
00:05:01,860 --> 00:05:03,720
very similar file name before

112
00:05:03,720 --> 00:05:07,080
and also the wiper used by the Blue Note

113
00:05:07,080 --> 00:05:09,479
group has some

114
00:05:09,479 --> 00:05:11,820
these kind of code similarity with the

115
00:05:11,820 --> 00:05:14,940
Olympic history but but you know it's a

116
00:05:14,940 --> 00:05:16,919
common code for

117
00:05:16,919 --> 00:05:20,759
uh while wiping securely so I cannot

118
00:05:20,759 --> 00:05:22,680
charge only using this constant

119
00:05:22,680 --> 00:05:25,340
similarities

120
00:05:26,520 --> 00:05:29,419
and the additional things that

121
00:05:29,419 --> 00:05:32,639
consolidate consolidate my bias was

122
00:05:32,639 --> 00:05:36,000
which headers very famous research from

123
00:05:36,000 --> 00:05:39,120
my colleague and this is the rich header

124
00:05:39,120 --> 00:05:41,160
is an undocumented header in the key

125
00:05:41,160 --> 00:05:44,460
file it contains a minor version of a

126
00:05:44,460 --> 00:05:46,979
compiler the unique identifier of the

127
00:05:46,979 --> 00:05:48,539
type of objects

128
00:05:48,539 --> 00:05:51,000
and how many times it is used by the

129
00:05:51,000 --> 00:05:54,840
Lincoln so therefore if the developer

130
00:05:54,840 --> 00:05:56,940
used a different number of source code

131
00:05:56,940 --> 00:05:59,400
and the development environment the rich

132
00:05:59,400 --> 00:06:04,340
header could be had a different values

133
00:06:05,400 --> 00:06:08,179
so

134
00:06:13,139 --> 00:06:15,660
so we extract which header from the

135
00:06:15,660 --> 00:06:18,960
wiper malware and made a data rule

136
00:06:18,960 --> 00:06:23,039
to run to our repository and you know we

137
00:06:23,039 --> 00:06:25,259
are the antivirus company which means we

138
00:06:25,259 --> 00:06:27,660
have a hundreds of us millions of

139
00:06:27,660 --> 00:06:31,080
malware in our repository but using this

140
00:06:31,080 --> 00:06:33,960
data rules only four blender malware was

141
00:06:33,960 --> 00:06:35,220
detected

142
00:06:35,220 --> 00:06:37,440
and it means the Olympic District of

143
00:06:37,440 --> 00:06:39,600
malware and blue not from malware will

144
00:06:39,600 --> 00:06:41,819
develop in the same environment where

145
00:06:41,819 --> 00:06:43,800
where the same developer

146
00:06:43,800 --> 00:06:47,460
so I almost conclude the blue notebook

147
00:06:47,460 --> 00:06:50,520
was behind the panchang Olympic Cyber

148
00:06:50,520 --> 00:06:52,639
attack

149
00:06:53,099 --> 00:06:55,940
however

150
00:06:56,039 --> 00:06:58,380
yeah my colleagues start to look into

151
00:06:58,380 --> 00:07:01,800
each other and according to the retailer

152
00:07:01,800 --> 00:07:04,259
information from the white pomalware it

153
00:07:04,259 --> 00:07:06,599
was developed by Microsoft Visual Studio

154
00:07:06,599 --> 00:07:09,720
6 and after carefully look checking the

155
00:07:09,720 --> 00:07:13,139
malware we find figure out is not mesh

156
00:07:13,139 --> 00:07:15,660
with the information from the source

157
00:07:15,660 --> 00:07:17,580
code internal source code

158
00:07:17,580 --> 00:07:20,220
and first Olympic history contains the

159
00:07:20,220 --> 00:07:23,720
MS corey.dlm module and which is the

160
00:07:23,720 --> 00:07:25,979
microsoft.net one-time execution engine

161
00:07:25,979 --> 00:07:28,860
and this module was introduced after

162
00:07:28,860 --> 00:07:31,800
Visual Studio 6 which means the video

163
00:07:31,800 --> 00:07:34,979
Studio 6 never adds this module

164
00:07:34,979 --> 00:07:37,319
automatically

165
00:07:37,319 --> 00:07:40,199
the other conclusive evidence was the

166
00:07:40,199 --> 00:07:42,919
team main CRT startup entry functions

167
00:07:42,919 --> 00:07:46,919
and that is is only produced with the

168
00:07:46,919 --> 00:07:49,919
one-time Library msqc 10 using the

169
00:07:49,919 --> 00:07:52,740
keyboard optimization options

170
00:07:52,740 --> 00:07:54,180
and

171
00:07:54,180 --> 00:07:58,500
only uh on top of that the the whole

172
00:07:58,500 --> 00:08:01,259
Olympic history of wiper was compiled on

173
00:08:01,259 --> 00:08:04,680
December 27 2017.

174
00:08:04,680 --> 00:08:07,440
it's almost one and a half months

175
00:08:07,440 --> 00:08:08,940
earlier from the Olympic opening

176
00:08:08,940 --> 00:08:11,940
ceremony but there is one sample that is

177
00:08:11,940 --> 00:08:15,780
compiled on February 9 2018.

178
00:08:15,780 --> 00:08:18,360
on the exact the same data of Olympic

179
00:08:18,360 --> 00:08:19,860
ceremony

180
00:08:19,860 --> 00:08:22,919
maybe the malware order produced this

181
00:08:22,919 --> 00:08:26,099
sample urgently for some reason and it

182
00:08:26,099 --> 00:08:28,919
contains the original Rich headers as

183
00:08:28,919 --> 00:08:30,900
you can see the rich header of these

184
00:08:30,900 --> 00:08:34,679
samples contains Visual Studio 2010

185
00:08:34,679 --> 00:08:38,039
information so in conclusion the rich

186
00:08:38,039 --> 00:08:41,099
header from the wiper is a big maybe it

187
00:08:41,099 --> 00:08:44,640
is for first flight

188
00:08:44,640 --> 00:08:48,120
and to sum up the more real order behind

189
00:08:48,120 --> 00:08:49,880
the Olympics two year

190
00:08:49,880 --> 00:08:52,860
uh copy the rich header from the Blue

191
00:08:52,860 --> 00:08:55,740
Note model and paste it to their wiper

192
00:08:55,740 --> 00:09:00,060
to make a very sophisticated burst flag

193
00:09:00,060 --> 00:09:01,800
and this is

194
00:09:01,800 --> 00:09:04,260
very stunning first flag operation from

195
00:09:04,260 --> 00:09:07,260
the actors and at this point uh I

196
00:09:07,260 --> 00:09:10,260
realized that my initial hypothesis was

197
00:09:10,260 --> 00:09:13,080
wrong I believe the blue model of screw

198
00:09:13,080 --> 00:09:16,320
is behind this attack but at this point

199
00:09:16,320 --> 00:09:18,240
we cannot figure out the booster behind

200
00:09:18,240 --> 00:09:20,779
in this attack

201
00:09:21,300 --> 00:09:23,940
and beside the witch header story we

202
00:09:23,940 --> 00:09:26,580
find the we found additional victim from

203
00:09:26,580 --> 00:09:28,860
the South Korea and they are the skill

204
00:09:28,860 --> 00:09:31,320
results and compromised by the same

205
00:09:31,320 --> 00:09:34,380
Olympic history malware at the same time

206
00:09:34,380 --> 00:09:38,220
so I contact them and decide to visit

207
00:09:38,220 --> 00:09:41,100
them to help so I quickly packed and

208
00:09:41,100 --> 00:09:44,700
went there using my car and we started

209
00:09:44,700 --> 00:09:47,040
investigations

210
00:09:47,040 --> 00:09:49,860
and there are so much evidence still

211
00:09:49,860 --> 00:09:52,740
remaining at the scaviors and I

212
00:09:52,740 --> 00:09:55,380
collected all files and all this

213
00:09:55,380 --> 00:09:58,459
community of patience General post and

214
00:09:58,459 --> 00:10:01,740
logs from many hosts and as a as a

215
00:10:01,740 --> 00:10:04,200
result of this on-site investigations I

216
00:10:04,200 --> 00:10:07,440
found I can found how this redactor

217
00:10:07,440 --> 00:10:10,860
infiltrates and move laterally to the

218
00:10:10,860 --> 00:10:13,440
high privilege host and run the Olympic

219
00:10:13,440 --> 00:10:16,339
history of malware

220
00:10:17,720 --> 00:10:19,320
so

221
00:10:19,320 --> 00:10:21,720
yeah through this investigation we can

222
00:10:21,720 --> 00:10:24,839
acquires a lot of evidence for initial

223
00:10:24,839 --> 00:10:27,360
infection the actor compromise

224
00:10:27,360 --> 00:10:30,120
the third party software they are

225
00:10:30,120 --> 00:10:32,100
managed internal software for skill

226
00:10:32,100 --> 00:10:36,300
region to control those key gate opening

227
00:10:36,300 --> 00:10:38,640
and the actors sneak into the server

228
00:10:38,640 --> 00:10:42,120
almost one week before the Olympic

229
00:10:42,120 --> 00:10:44,399
opening ceremony and

230
00:10:44,399 --> 00:10:47,279
the threat actor heavily relied on the

231
00:10:47,279 --> 00:10:49,740
culture tools such as publisher Empire

232
00:10:49,740 --> 00:10:51,839
and the pulse Floyd

233
00:10:51,839 --> 00:10:54,420
and the actor used a common method for

234
00:10:54,420 --> 00:10:57,480
lateral movement using the psexcc and

235
00:10:57,480 --> 00:10:58,740
meter printer

236
00:10:58,740 --> 00:11:02,279
and also we discovered we discovered a

237
00:11:02,279 --> 00:11:05,040
lot of additional addresses even the

238
00:11:05,040 --> 00:11:07,140
TeamViewer server address the actual

239
00:11:07,140 --> 00:11:08,279
views

240
00:11:08,279 --> 00:11:10,500
and based on this finding we can

241
00:11:10,500 --> 00:11:12,959
conclude that the tools and techniques

242
00:11:12,959 --> 00:11:15,959
and procedures of of the actors behind

243
00:11:15,959 --> 00:11:18,420
the Olympic distributor was totally

244
00:11:18,420 --> 00:11:21,000
different from the Blue Note group so we

245
00:11:21,000 --> 00:11:26,300
named them different HD actors Hades

246
00:11:27,140 --> 00:11:31,320
and yeah in this research I failed I

247
00:11:31,320 --> 00:11:34,440
failed the early stage because uh first

248
00:11:34,440 --> 00:11:36,800
of all in inpatient conclusion with the

249
00:11:36,800 --> 00:11:40,140
insufficient evidence at all stage and I

250
00:11:40,140 --> 00:11:44,100
also had a strong bias that the sabotage

251
00:11:44,100 --> 00:11:46,680
attack against South Korea could be

252
00:11:46,680 --> 00:11:49,140
related to the North Korean student

253
00:11:49,140 --> 00:11:52,139
vectors uh that is the reason I made a

254
00:11:52,139 --> 00:11:55,339
wrong conclusion at the beginning

255
00:11:55,579 --> 00:11:58,920
and yeah the next period of cases

256
00:11:58,920 --> 00:12:03,360
happened because of my over reliance

257
00:12:03,360 --> 00:12:06,060
this story is about the conflict between

258
00:12:06,060 --> 00:12:08,399
two student actors the Skycraft and the

259
00:12:08,399 --> 00:12:09,420
dark Hotel

260
00:12:09,420 --> 00:12:11,880
and Skycraft was published by the

261
00:12:11,880 --> 00:12:15,660
Kaspersky in 2016. they primarily

262
00:12:15,660 --> 00:12:18,240
targeting the entities in South Korea

263
00:12:18,240 --> 00:12:20,940
and that hotel also published by the

264
00:12:20,940 --> 00:12:23,579
cosmos key in 2014

265
00:12:23,579 --> 00:12:26,760
the compromising the hotel Network and

266
00:12:26,760 --> 00:12:30,000
attacking high-profile individuals

267
00:12:30,000 --> 00:12:31,860
even though they use the different

268
00:12:31,860 --> 00:12:34,440
techniques they have a lot of algorithms

269
00:12:34,440 --> 00:12:37,800
the Korean speaking actors they have

270
00:12:37,800 --> 00:12:40,380
similar victimologists and sometimes

271
00:12:40,380 --> 00:12:43,680
using the similar techniques I've seen

272
00:12:43,680 --> 00:12:46,800
some warrior code overall before and

273
00:12:46,800 --> 00:12:48,839
definitely one group want to hide the

274
00:12:48,839 --> 00:12:52,440
others groups share them

275
00:12:52,440 --> 00:12:55,680
and my other colleague the confliction

276
00:12:55,680 --> 00:12:58,680
between these these two groups was

277
00:12:58,680 --> 00:13:00,720
introduced previously

278
00:13:00,720 --> 00:13:04,500
uh they are two they're they're also two

279
00:13:04,500 --> 00:13:06,360
different uh operations operation

280
00:13:06,360 --> 00:13:09,779
arrivals was done by the Skycraft with

281
00:13:09,779 --> 00:13:11,639
the watering all the tank and operation

282
00:13:11,639 --> 00:13:14,040
Daybreak was related to the dark hotel

283
00:13:14,040 --> 00:13:16,800
with the spearfishing hotel and at first

284
00:13:16,800 --> 00:13:19,139
the customer skills are confused both

285
00:13:19,139 --> 00:13:22,800
operations and conclude the Skycraft was

286
00:13:22,800 --> 00:13:24,899
behind the dose operations operation

287
00:13:24,899 --> 00:13:27,540
Edibles and operation day Bridge

288
00:13:27,540 --> 00:13:30,000
the reason makes this conclusion was

289
00:13:30,000 --> 00:13:32,639
both operations use the same C2 servers

290
00:13:32,639 --> 00:13:35,820
but after looking into it we figured out

291
00:13:35,820 --> 00:13:39,240
that possibly on group compromised the

292
00:13:39,240 --> 00:13:41,639
other groups to seek to server and each

293
00:13:41,639 --> 00:13:45,180
operation has a very different ttps

294
00:13:45,180 --> 00:13:48,720
so we conclude that operation variables

295
00:13:48,720 --> 00:13:52,380
was the Skycraft groups operation and

296
00:13:52,380 --> 00:13:55,680
operation Daybreak was

297
00:13:55,680 --> 00:13:57,360
yeah

298
00:13:57,360 --> 00:14:00,120
I didn't I haven't seen the two groups

299
00:14:00,120 --> 00:14:03,000
were conflicting another case we

300
00:14:03,000 --> 00:14:06,120
observed one large Ambit team

301
00:14:06,120 --> 00:14:08,399
he's possibly the businessman or

302
00:14:08,399 --> 00:14:10,980
diplomat and this big team was

303
00:14:10,980 --> 00:14:13,139
compromised by dark Hotel malware in

304
00:14:13,139 --> 00:14:17,160
March 2018 and Skycraft group also

305
00:14:17,160 --> 00:14:21,600
manipulated his host in September 2018.

306
00:14:21,600 --> 00:14:23,820
and also the Coney third actor

307
00:14:23,820 --> 00:14:26,279
compromise resources as well and as we

308
00:14:26,279 --> 00:14:28,920
can see the duck hotel and Chicago has a

309
00:14:28,920 --> 00:14:32,040
very similar Target list and discovered

310
00:14:32,040 --> 00:14:36,560
from the same post from time to time

311
00:14:36,600 --> 00:14:40,100
okay then let's see my mistake

312
00:14:40,100 --> 00:14:42,360
uh one day

313
00:14:42,360 --> 00:14:45,360
Chinese security vendor publisher

314
00:14:45,360 --> 00:14:47,639
some oops sorry

315
00:14:47,639 --> 00:14:50,279
probably some known apt actually use the

316
00:14:50,279 --> 00:14:53,820
Internet Explorer they exploit use with

317
00:14:53,820 --> 00:14:57,540
the word documents and unfortunately

318
00:14:57,540 --> 00:14:59,519
there is no detailed indicators

319
00:14:59,519 --> 00:15:02,220
published so I have to find the samples

320
00:15:02,220 --> 00:15:03,480
by myself

321
00:15:03,480 --> 00:15:06,300
but luckily I found the word sentoun

322
00:15:06,300 --> 00:15:10,260
from the virus total somehow and SNS I

323
00:15:10,260 --> 00:15:12,959
found the sample I tried to find the

324
00:15:12,959 --> 00:15:14,240
additional

325
00:15:14,240 --> 00:15:17,040
documented samples using the virus total

326
00:15:17,040 --> 00:15:20,040
similar to functionalities I never want

327
00:15:20,040 --> 00:15:22,139
to blame the capability of virus total

328
00:15:22,139 --> 00:15:25,139
it's my daily hunting platform and I can

329
00:15:25,139 --> 00:15:27,899
imagine the working without it but at

330
00:15:27,899 --> 00:15:31,139
this time I was overly trusting its

331
00:15:31,139 --> 00:15:33,120
wizard but I was total similar to

332
00:15:33,120 --> 00:15:36,480
function widgets maybe the similar two

333
00:15:36,480 --> 00:15:39,060
features find the similar samples based

334
00:15:39,060 --> 00:15:40,920
on the metadata such as the language

335
00:15:40,920 --> 00:15:43,620
characteristics and structure of the

336
00:15:43,620 --> 00:15:44,940
files but

337
00:15:44,940 --> 00:15:47,519
I ignore the possibility that this

338
00:15:47,519 --> 00:15:50,480
result could include

339
00:15:50,480 --> 00:15:53,880
non-precise result

340
00:15:53,880 --> 00:15:58,980
so I started to fall into long Rabbit

341
00:15:58,980 --> 00:16:01,380
Hole whilst I list of the whole document

342
00:16:01,380 --> 00:16:04,620
from the BIOS total and several C2

343
00:16:04,620 --> 00:16:06,660
servers connect connected by the

344
00:16:06,660 --> 00:16:10,079
dimensions document already published by

345
00:16:10,079 --> 00:16:12,420
other vendors and they said

346
00:16:12,420 --> 00:16:14,820
it is to relate to the scatter of the

347
00:16:14,820 --> 00:16:18,480
group's activity also a lot of decoy

348
00:16:18,480 --> 00:16:20,100
documents contains on North Korean

349
00:16:20,100 --> 00:16:22,500
Expressions the South Korean and the

350
00:16:22,500 --> 00:16:24,180
North Korean language expression are

351
00:16:24,180 --> 00:16:27,060
totally different and in this case the

352
00:16:27,060 --> 00:16:29,940
actor used the North Korean expressions

353
00:16:29,940 --> 00:16:33,720
and it makes me uh become more confident

354
00:16:33,720 --> 00:16:36,480
that the scaffold Factor behind this

355
00:16:36,480 --> 00:16:38,899
campaign

356
00:16:40,860 --> 00:16:43,139
and

357
00:16:43,139 --> 00:16:46,380
but uh when I cross-checked This

358
00:16:46,380 --> 00:16:48,600
research with my colleague we figured

359
00:16:48,600 --> 00:16:50,699
out that the malware used in this

360
00:16:50,699 --> 00:16:53,220
campaign has connection to the operation

361
00:16:53,220 --> 00:16:55,980
Daybreak and at the

362
00:16:55,980 --> 00:16:57,899
at the early stage I confused the

363
00:16:57,899 --> 00:16:59,759
operation Daybreak was belonged to

364
00:16:59,759 --> 00:17:03,660
Skycraft and but it was a dark hotel and

365
00:17:03,660 --> 00:17:06,660
finally I conclude this operation

366
00:17:06,660 --> 00:17:09,480
operation sound check was conducted by

367
00:17:09,480 --> 00:17:12,679
the Dakota group

368
00:17:13,140 --> 00:17:15,839
and there was a similar experience one

369
00:17:15,839 --> 00:17:18,480
day I found a bunch of similar samples

370
00:17:18,480 --> 00:17:21,059
that contains New Year greeting message

371
00:17:21,059 --> 00:17:24,359
in Korean and North Korean pictures and

372
00:17:24,359 --> 00:17:26,939
pictures were documents about

373
00:17:26,939 --> 00:17:29,700
uh North Korean Diplomat and during this

374
00:17:29,700 --> 00:17:33,179
research I discovered some evidence that

375
00:17:33,179 --> 00:17:35,580
dark Hotel was behind this campaign

376
00:17:35,580 --> 00:17:38,280
first the victim was overlapped with the

377
00:17:38,280 --> 00:17:40,440
previous stack Hotel operations kind of

378
00:17:40,440 --> 00:17:43,559
diploma related to the North Korea

379
00:17:43,559 --> 00:17:46,980
and malware contains a strange user

380
00:17:46,980 --> 00:17:49,620
agent stream you can see the KP KP is

381
00:17:49,620 --> 00:17:52,039
the North Korean country code

382
00:17:52,039 --> 00:17:55,440
also the working time zone based on the

383
00:17:55,440 --> 00:17:57,840
mobile compilation time and the comment

384
00:17:57,840 --> 00:18:01,550
execution time was GMT plus 819

385
00:18:01,550 --> 00:18:03,000
[Music]

386
00:18:03,000 --> 00:18:06,419
and additionally the several decoys used

387
00:18:06,419 --> 00:18:10,740
North Korean font named Charlie McCombs

388
00:18:10,740 --> 00:18:13,080
and the reason that I

389
00:18:13,080 --> 00:18:15,960
the reason influenced my decision on lab

390
00:18:15,960 --> 00:18:19,080
was the other vendors said the same

391
00:18:19,080 --> 00:18:21,000
degree document was employed by the

392
00:18:21,000 --> 00:18:22,500
Dakota group before

393
00:18:22,500 --> 00:18:24,480
but there are some no strong evidence

394
00:18:24,480 --> 00:18:28,260
why it is connected to the Dakota and

395
00:18:28,260 --> 00:18:31,320
that's that was my foot I believe others

396
00:18:31,320 --> 00:18:35,418
research without my own verifications

397
00:18:35,640 --> 00:18:38,340
and regarding this campaign many vendors

398
00:18:38,340 --> 00:18:41,910
publish their own technical descriptions

399
00:18:41,910 --> 00:18:44,979
[Music]

400
00:18:45,559 --> 00:18:49,140
and attributions and one vendor said the

401
00:18:49,140 --> 00:18:51,419
Polish government got spearfishing

402
00:18:51,419 --> 00:18:54,059
disguised as a Chinese government and

403
00:18:54,059 --> 00:18:56,400
another vendor said is relate to the

404
00:18:56,400 --> 00:18:59,520
Korean peninsula and the other said it's

405
00:18:59,520 --> 00:19:02,340
not related to the Dakota group it's a

406
00:19:02,340 --> 00:19:04,799
sub group of dark hotel and so many

407
00:19:04,799 --> 00:19:06,900
different and on solely the publishment

408
00:19:06,900 --> 00:19:09,660
were out about this attempt and in

409
00:19:09,660 --> 00:19:12,720
conclusion my attribution was to Hasty

410
00:19:12,720 --> 00:19:15,780
at the early stage and we are tracking

411
00:19:15,780 --> 00:19:17,840
this group as a different group named

412
00:19:17,840 --> 00:19:21,020
coughing down

413
00:19:21,720 --> 00:19:24,179
you know I I made a mistake in this case

414
00:19:24,179 --> 00:19:27,539
because I was I was deceived by the

415
00:19:27,539 --> 00:19:30,059
sophisticated first flag one girl want

416
00:19:30,059 --> 00:19:33,299
to hide the other's Shadow so they tried

417
00:19:33,299 --> 00:19:36,720
to use very sophisticated first flag

418
00:19:36,720 --> 00:19:38,100
and

419
00:19:38,100 --> 00:19:41,220
language skills are very important for

420
00:19:41,220 --> 00:19:43,679
threat intelligence researcher but as

421
00:19:43,679 --> 00:19:45,960
you can see sometimes it makes me more

422
00:19:45,960 --> 00:19:50,100
confusing so because we there are still

423
00:19:50,100 --> 00:19:51,780
two kind of Korean North Korean

424
00:19:51,780 --> 00:19:54,299
expression and South Korean depression

425
00:19:54,299 --> 00:19:57,600
so we should be careful when we check

426
00:19:57,600 --> 00:19:59,760
the language characteristics

427
00:19:59,760 --> 00:20:03,059
also I was over reliant on the results

428
00:20:03,059 --> 00:20:06,240
of a virus total and over trusted the

429
00:20:06,240 --> 00:20:08,159
others report without my own

430
00:20:08,159 --> 00:20:11,700
verifications and that's the reason why

431
00:20:11,700 --> 00:20:15,440
I was fooled in this research

432
00:20:16,440 --> 00:20:20,760
and let's see the last panelist case

433
00:20:20,760 --> 00:20:22,559
I think

434
00:20:22,559 --> 00:20:24,659
some of you guys heard about the

435
00:20:24,659 --> 00:20:27,840
operation apple juice and it is campaign

436
00:20:27,840 --> 00:20:29,820
of the largest group attacking the

437
00:20:29,820 --> 00:20:32,220
cryptocurrency industry with a fake

438
00:20:32,220 --> 00:20:35,280
company as well as the first case of

439
00:20:35,280 --> 00:20:37,380
using the Mac OS model by the larger

440
00:20:37,380 --> 00:20:38,220
School

441
00:20:38,220 --> 00:20:41,100
and one day we discovered the infection

442
00:20:41,100 --> 00:20:44,159
from One cryptocurrency exchange they

443
00:20:44,159 --> 00:20:46,080
were compromised by known rather

444
00:20:46,080 --> 00:20:47,220
smallware

445
00:20:47,220 --> 00:20:49,799
and as a result of backtracking the

446
00:20:49,799 --> 00:20:52,620
infection procedures we figured out that

447
00:20:52,620 --> 00:20:54,120
the compromise cryptocurrency

448
00:20:54,120 --> 00:20:57,299
application was downloaded from the

449
00:20:57,299 --> 00:20:59,820
company's website the website name is

450
00:20:59,820 --> 00:21:02,760
the sellers llc.com

451
00:21:02,760 --> 00:21:05,640
and the update module from the

452
00:21:05,640 --> 00:21:07,919
cryptocurrency application connected to

453
00:21:07,919 --> 00:21:12,059
this company server so I thought this is

454
00:21:12,059 --> 00:21:15,000
the normal update process usually many

455
00:21:15,000 --> 00:21:18,480
applications do the update check when we

456
00:21:18,480 --> 00:21:20,059
just

457
00:21:20,059 --> 00:21:23,520
started so at the initial stage of This

458
00:21:23,520 --> 00:21:26,159
research I thought the sellers companies

459
00:21:26,159 --> 00:21:28,620
supply chain was compromised and

460
00:21:28,620 --> 00:21:31,080
delivered the malicious application to

461
00:21:31,080 --> 00:21:34,740
their customer so I I very kindly inform

462
00:21:34,740 --> 00:21:37,260
them by email your server is suspicious

463
00:21:37,260 --> 00:21:41,340
so I introduced myself very kindly hello

464
00:21:41,340 --> 00:21:45,240
this is a sunspot from Kaspersky lab and

465
00:21:45,240 --> 00:21:47,400
we share the whole status

466
00:21:47,400 --> 00:21:50,940
all my research status with them

467
00:21:50,940 --> 00:21:53,100
but

468
00:21:53,100 --> 00:21:56,340
there was a no reply from them even even

469
00:21:56,340 --> 00:21:59,280
their website when offline the next day

470
00:21:59,280 --> 00:22:03,539
after sending my email and they enhanced

471
00:22:03,539 --> 00:22:06,179
their operational security when when I

472
00:22:06,179 --> 00:22:08,700
first checked the last website anyone

473
00:22:08,700 --> 00:22:10,440
can download their compromised

474
00:22:10,440 --> 00:22:13,980
applications but after my email they

475
00:22:13,980 --> 00:22:17,220
added an email verification process if

476
00:22:17,220 --> 00:22:19,380
someone wants to get their installation

477
00:22:19,380 --> 00:22:21,960
package they need to put an email

478
00:22:21,960 --> 00:22:25,860
address and only verify the client can

479
00:22:25,860 --> 00:22:27,360
receive the program

480
00:22:27,360 --> 00:22:30,000
it means that I help them to enhance

481
00:22:30,000 --> 00:22:33,240
their operational security and this is a

482
00:22:33,240 --> 00:22:37,260
quite embarrassing experience for me

483
00:22:37,260 --> 00:22:39,960
and when I carefully look into their

484
00:22:39,960 --> 00:22:42,299
infrastructure there were there were

485
00:22:42,299 --> 00:22:45,299
many points I should have suspecting

486
00:22:45,299 --> 00:22:47,820
the address from the SSS certification

487
00:22:47,820 --> 00:22:51,659
is fake and it is a strange placement I

488
00:22:51,659 --> 00:22:53,700
checked from the Google Map

489
00:22:53,700 --> 00:22:57,240
and if I checked their infra structure

490
00:22:57,240 --> 00:22:59,760
carefully maybe I didn't send the email

491
00:22:59,760 --> 00:23:01,020
to them

492
00:23:01,020 --> 00:23:03,918
and

493
00:23:05,580 --> 00:23:07,860
in this case the operation approaches

494
00:23:07,860 --> 00:23:10,559
case I was Smoked by Abundant

495
00:23:10,559 --> 00:23:12,900
preparation from the Lazarus group they

496
00:23:12,900 --> 00:23:16,860
configured the big website with the SSL

497
00:23:16,860 --> 00:23:19,740
certificates and develop or big

498
00:23:19,740 --> 00:23:22,200
cryptocurrency trading application to

499
00:23:22,200 --> 00:23:25,260
deceive the victim actually they manage

500
00:23:25,260 --> 00:23:26,940
the click the company

501
00:23:26,940 --> 00:23:29,760
also they operate a kind of a support

502
00:23:29,760 --> 00:23:33,179
center in another email conversation not

503
00:23:33,179 --> 00:23:35,820
an initial email another email

504
00:23:35,820 --> 00:23:38,100
conversation to get an additional

505
00:23:38,100 --> 00:23:40,919
application they replied to my email

506
00:23:40,919 --> 00:23:43,559
with a very nice English

507
00:23:43,559 --> 00:23:46,500
and despite we made an interesting

508
00:23:46,500 --> 00:23:49,679
research research on operation

509
00:23:49,679 --> 00:23:52,919
approaches I made a hasty decision at

510
00:23:52,919 --> 00:23:55,440
the beginning so that I notified the

511
00:23:55,440 --> 00:24:00,380
actor we recognized their campaigns

512
00:24:01,440 --> 00:24:04,200
yeah those are the failure changes I

513
00:24:04,200 --> 00:24:06,900
would like to share the attribution is

514
00:24:06,900 --> 00:24:10,440
matter but it's very hard because we

515
00:24:10,440 --> 00:24:13,380
need to still rely on the many points

516
00:24:13,380 --> 00:24:17,039
for manual jobs and as a human beings we

517
00:24:17,039 --> 00:24:21,240
have a lot of stereotypes and biases so

518
00:24:21,240 --> 00:24:23,700
we can easily compromise by the first

519
00:24:23,700 --> 00:24:26,760
flag and the other things that can

520
00:24:26,760 --> 00:24:28,919
affect our decisions

521
00:24:28,919 --> 00:24:31,980
so we should very carefully bring the

522
00:24:31,980 --> 00:24:34,260
conclusions and judge something after

523
00:24:34,260 --> 00:24:37,020
collecting evidence as much as we can

524
00:24:37,020 --> 00:24:38,880
but I know it's a very challenging

525
00:24:38,880 --> 00:24:41,460
process but we need to do our best for

526
00:24:41,460 --> 00:24:43,320
this and sometimes

527
00:24:43,320 --> 00:24:46,080
as a sort of intelligence analyst we

528
00:24:46,080 --> 00:24:49,080
need a kind of responsibility when we

529
00:24:49,080 --> 00:24:51,240
publish something especially the

530
00:24:51,240 --> 00:24:54,059
attributions because it can bring a lot

531
00:24:54,059 --> 00:24:56,700
of chaos to our industry

532
00:24:56,700 --> 00:24:59,880
and the last thing I want to share is a

533
00:24:59,880 --> 00:25:02,039
quotation quotation from the professor

534
00:25:02,039 --> 00:25:05,100
Richard Raymond he said you learn

535
00:25:05,100 --> 00:25:08,400
nothing from life if you think you are

536
00:25:08,400 --> 00:25:11,100
right all the time so yeah we should

537
00:25:11,100 --> 00:25:14,760
admit we can't be wrong and sometimes we

538
00:25:14,760 --> 00:25:19,220
need to learn from our Behavior I think

539
00:25:19,220 --> 00:25:22,980
yep that's it I hope my presentation is

540
00:25:22,980 --> 00:25:26,700
useful to someone so if you have any

541
00:25:26,700 --> 00:25:28,980
questions please leave a question stop

542
00:25:28,980 --> 00:25:31,980
looking Village Discord Channel I will

543
00:25:31,980 --> 00:25:34,200
get along the end at that channel this

544
00:25:34,200 --> 00:25:36,720
book Channel or send your question to my

545
00:25:36,720 --> 00:25:40,080
Twitter or email and I will reply soon

546
00:25:40,080 --> 00:25:43,939
and thank you for your attentions