Hi everyone. First of all, thank you for having me, DEF CON Blue Team Village team, and thank
you for joining my presentations. Most of the security researchers would like to share
their great findings and excellent achievements through the security conference, but in this
talk, I would like to share my failure in the threat intelligence industry. So the title
is attribution and bias, my terrible mistakes in threat intelligence attributions. Then
let's start. Yeah, before moving on, allow me to introduce myself briefly. My name is
Sonspa from South Korea, and I'm working in Kaspersky, great global research and analysis
team as a lead security researcher.
And I'm the only one who can speak the Korean in our team. So I'm usually tracking the
Korean speaking threat actors, such as Lazarus and Bluenorov, Kinski, Duck Hotel, and Skycroft.
And yeah, I believe the attendees of this conference already knew about what is the
threat intelligence and attributions, but for the people who are not familiar with them,
let me introduce them.
Let me start off briefly. The threat intelligence or the cyber threat intelligence is a kind
of information gathered from various sources, and about current or the potential cyber attack
against organizations or individuals. And I think the key point of threat intelligence
is evidence-based and actionable advice. A threat intelligence researcher like me
produce the actionable items to respond to cyber attack.
Even if it's not the truth, it's just the Fall down, or it's historical evidence.
At the same time, the threat intelligence also appears in a maybe more intense, than
the mechanism of the threat intelligence organization.
And it can be anything, from the most recent and latest threat intelligence in this country
to the most recent in the world.
So the threat intelligence, you know, all of the data, all the medical data, all the
system, all the data being in remote areas, all the data being seen as an objective,
and the overall picture of every cell could be different.
Now I'm going to talk about my real experience with this threat intelligence.
Then let's start to talk about my terrible failure experience in the threat intelligence
industry.
The first case was caused by my perception of bias, and maybe you already know about
the Olympic destroyer target, the PyeongChang Winter Olympics.
It happened on February 8th, 2018, 8 p.m. the local time, the exact same time the Winter
Olympics opening ceremony began.
This sabotage attack accompanied Wiper malware, so it made a lot of damage to the Olympic
Committee.
According to the Olympic Committee, more than 300 servers were affected, and many critical
services were suspended, including Wi-Fi, email, transport, and accommodations, because
of this Olympic destroyer attack.
Olympic destroyer is...
Wormable malware that spreads itself with destruction capability.
It consists of 4 components, the window credential stealer, browser credential stealer, PSE-ex.
tool for lateral movements, and the Wiper malware for system destruction.
You can see that the other components are based on the public source code, such as
mini-cards.
The only malware that can be used for finding code similarity with other malware was the
So, a lot of vendors start to dig into this wipe-on malware.
And in the early stage of Olympic de-history research, many vendors were confused who is
behind this attack.
One vendor said it is related to the NaPetya or dark web incident, and the other vendor
urged that it was letters.
And another vendor said the Chinese-speaking actor was behind this attack.
And I also started to look into this malware.
And at the beginning of this research, I had some bias.
And historically, ladders were BlueNorth group conducted sabotage attack with the wipe-on
malware.
So, I think this case could be associated with these groups as well, BlueNorth or ladders.
And with this biased perception, I start to find the evidence to fit into my wrong conclusion.
And first of all, the file name of Olympic de-history used had some similarity with the
BlueNorth group used before.
You can see the Olympic de-history used the evtchk.txt file, and previously, the BlueNorth
group used a very similar file name before.
And also, the wiper used by the BlueNorth group has some similarity.
But, you know, it's a common code for file wiping securely, so I cannot judge only using
these code similarities.
And the additional things that consolidate my bias was witch-headers, a very famous research
from my colleague.
And the witch-headers are very common.
The witch-header is an undocumented header in the p-file.
It contains a minor version of a compiler, the unique identifier of the type of object,
and how many times it is used by the link.
So therefore, if the developer used a different number of source code and development environment,
the witch-header could have different values.
So, we extracted the witch-header from the wiper malware and made a YARA rule to run to
our repository.
And, you know, we are the antivirus company, which means we have hundreds of millions of
malware in our repository.
But using this YARA rule, only four BlueNorth malware was detected.
And it means the Olympic de-history malware and BlueNorth malware are the same.
So, I almost conclude the BlueNorth rule was behind the PyeongChang Olympic cyberattack.
However, yeah, my colleague started looking into the witch-header, and according to the
witch-header information from the wiper malware, it was developed by Microsoft Visual Studio
6.
And after carefully checking the malware, we figured out it's not matched with the information
from the source code, internal source code.
And first, the Olympic de-history contains the mscoree.dll module, which is the Microsoft
.NET runtime execution engine.
And this module was introduced after Visual Studio 6, which means Visual Studio 6 never
adds this module automatically.
So, it's a bit confusing.
The other conclusive evidence was the team-made CRT start-up entry functions.
And that is only produced with the runtime library MSVC 10 using the default optimization
options.
And on top of that, the whole Olympic de-history wiper was compiled on December 27, 2017.
It's almost one-ended.
So, it's a bit confusing.
Because it's only been half a month earlier from the Olympic opening ceremony.
But there is one sample that is compiled on February 9, 2018, on the exact same date of
the Olympic ceremony.
Maybe the malware order produced this sample urgently for some reason, and it contains
the original witch-headers.
As you can see, the witch-header of this sample contains Visual Studio 2010 information.
So, it contains the original witch-headers.
In conclusion, the witch-header from the wiper is a fake.
Maybe it is for the first flag.
And to sum up, the malware order behind the Olympic de-history copied the witch-header
from the balloon of the malware and pasted it to their wiper to make a very sophisticated
first flag.
And this is a very stunning first flag operation from the actors.
And at this point, it's a bit confusing.
I realized that my initial hypothesis was wrong.
I believe the balloon of the screw was behind this attack.
But at this point, we cannot figure out who is behind this attack.
Besides the witch-header story, we found additional victims from South Korea.
And they are skilled resorts and compromised by the same Olympic de-history malware at
the same time.
So, I contacted them.
And decided to visit them to help.
So, I quickly packed and went there using my car.
And we started investigations.
And there are so much evidence still remaining at the skilled resorts.
And I collected all files and disk images of patients, general hosts, and logs from
many hosts.
And as a result of these on-site investigations, I found…
I can find…
I can find out how these threat actors infiltrate and move laterally to the high-privileged
host and run the Olympic de-history of malware.
So, yeah.
Through this investigation, we can acquire a lot of evidence for initial infection.
The actors compromised the third-party software.
They managed the internal software for skilled resorts to control the key gate opening.
So, this is the result.
And the actors sneaked into the server almost one week before the Olympic opening ceremony.
And the threat actors heavily relied on the PowerShell tools, such as PowerShell Empire
and PowerSploit.
And the actors used a common method for lateral movement using the PSEXAC and Metapriter.
And also, we discovered…
We discovered a lot of additional secret addresses.
Even the team view.
Even the server address the actors used.
And based on this finding, we can conclude that the tools and techniques and procedures
of the actors behind the Olympic de-history was totally different from the Bruno group.
So, we named them the different APT actors, HADES.
And in this research, I failed.
I failed the early stage because of impatience.
I made a sufficient conclusion with insufficient evidence at the early stage.
And I also had a strong bias that the sabotage attack against South Korea could be related
to the North Korean threat actors.
That is the reason I made a wrong conclusion at the beginning.
And the next failure cases happened because of my over-reliance.
This story is about conflict.
The conflict between South Korea and South Korea.
between two threat actors, the SkaCraft and the Dark Hotel, and SkaCraft was published
by the Kaspersky in 2016. They primarily targeting the entities in South Korea and Dark Hotel
also published by the Kaspersky in 2014. They compromising the hotel network and attacking
high profile individuals. Even though they use the different techniques, they have a
lot of overlaps. They are Korean speaking actors, they have similar victimologies and
sometimes using the similar techniques. I have seen some more real code overlap before
and definitely one group want to hide the other group's shadow. And by other colleagues,
the completion between these two groups was introduced previously. They are two different
There were also two different operations.
Operation Erebus was done by the SkaCraft with the watering hole attempt,
and Operation Daybreak was related to the Dark Hotel with the spearfishing attempt.
At first, Kaspersky also confused both operations and concluded that SkaCraft was behind those operations,
Operation Erebus and Operation Daybreak.
The reason for this conclusion was that both operations used the same C2D servers,
but after looking into it, we figured out that possibly one group compromised the other group's C2D server,
and each operation has very different TTPs.
So we conclude that Operation Erebus was the SkaCraft group's operation, and Operation Daybreak was the Dark Hotel.
I've even seen the two groups were conflicting in another case.
We observed one Russian big team is possibly the businessman or diplomat.
And this big team was compromised by Dark Hotel Malware in March 2018.
And the SkaCraft group also manipulated this host in September 2018.
And also, the Kony third actor compromised this host as well.
And as we can see, the Dark Hotel and SkaCraft has a very similar target list,
and discovered from the same host from time to time.
Okay, then let's see my mistake.
One day, Chinese security vendor published some known APTX used Internet Explorer 0-day exploit with Word documents.
Unfortunately, there is no detailed indicators published.
So I have to find the samples by myself.
But luckily, I found the Word sample from the VirusTotal somehow.
And as soon as I found the sample, I tried to find additional document samples using the VirusTotal similar to functionalities.
I never want to blame the capability of VirusTotal.
It's my daily hunting platform, and I can't imagine working without it.
But at this time, I was overwhelmed.
I was probably trusting its result, VirusTotal's similar-to-function results.
Maybe the similar-to features find similar samples based on the metadata,
such as the language characteristics and structure of the files.
But I ignored the possibility that this result could include non-precise results.
So I started to fall into a long rabbit hole.
First, I listed up the whole document from the VirusTotal.
And several C2 servers connected by the malicious document already published by other vendors.
And they said it is related to the scarecrow group's activity.
Also, a lot of decoy documents contain some North Korean expressions.
The South Korean and the North Korean language expressions are totally different.
And in this case, the actor used the North Korean expression.
It makes me become more confident that the scarecrow actor is behind this campaign.
But when I cross-checked this research with my colleague,
we figured out that the malware used in this campaign has connection to the Operation Daybreak.
And at the early stage, I confused the Operation Daybreak.
It was belong to SkaCraft.
But it was a dark hotel.
And finally, I concluded that this operation sound check was conducted by the dark hotel group.
And there was a similar experience.
One day, I found a bunch of similar samples that contains the New Year greeting message in Korean and North Korean pictures.
And pictures were documents about North Korean diplomats.
And during this research, I discovered some evidence that dark hotel was behind this campaign.
First, the victim was overlapped with previous dark hotel operations.
Kind of diplomat related to North Korea.
And the malware contains a strange user agent string.
You can see the KP.
KP is the North Korean country code.
Also, the working time zone based on the malware compilation time and command execution time.
The working time was GMT plus eight or nine zone.
And additionally, the several decoys used North Korean font named Charlie McFont.
And the reason that I, the reason influenced my decision a lot was the other vendors said the same decoy document was employed by the dark hotel group before.
But there was no strong evidence why it is connect to the dark hotel.
That was my fault.
I believe others research without my own verifications.
And regarding this campaign, many vendors published their own technical descriptions and attributions.
And one vendor said the Polish government got spear phishing these guys as Chinese government.
Another vendor said this relates to the Korean peninsula.
And the other said it's not related to the dark hotel group.
It's a subgroup of the dark hotel.
And so many different and unsolid publishments were out about this attack.
And in conclusion, my attribution was too hasty at the early stage.
And we are tracking this group as a different group named Coughing Down.
I made a mistake in this case because I was,
I was deceived by this.
So I made a sophisticated first flag.
One group want to hide the other's shadow.
So they tried to use very sophisticated first flag.
And language skill is very important for threat intelligence researcher.
But as you can see, sometimes it makes me more confusing.
So because we, there are two kind of Korean, North Korean expression and South Korean expression.
So we should be careful.
We should only check the language characteristics.
Also, I was over reliance on the results of a virus total and over trusted the other's report without my own verifications.
And that's the reason why I was fooled in this research.
And let's see the last but not least case.
I think some of you guys heard about the operation apple juice.
And it is campaign of a Lazarus group attacking the cryptocurrency industry with a fake company,
as well as the first case of using the macOS mobile by the Lazarus group.
And one day we discovered the infection from one cryptocurrency exchange.
They were compromised by known Lazarus mobile.
And as a result of backtracking the infection procedures,
we figured out that the compromised cryptocurrency application,
was downloaded from the company's website.
The website name is salaslnc.com.
And the update module from the cryptocurrency application connected to this company's server.
So I thought this is the normal update process.
Usually many applications do the update check when it just started.
So at the initial stage of this research,
I thought the Salas company's supply chain was compromised
and deliver the malicious application to their customer.
So I very kindly informed them by email.
Your server is suspicious.
So I introduced myself very kindly.
Hello, this is Sam Spark from Kaspersky Labs.
And shared the whole status, all my research status with them.
But there was also a problem.
There was no reply from them.
Even their website went offline the next day after sending my email.
And they enhanced their operational security.
When I first checked the Salas website,
anyone can download their compromised applications.
But after my email, they added an email verification process.
If someone wants to get their installation package,
they need to put an email address.
And only verified clients can receive the program.
It means that I helped them to enhance their operational security.
And this is a quite embarrassing experience for me.
And when I carefully looked into their infrastructure,
there were many points I should have suspected.
The address from the SSL certification is fake.
And it's a strange place
when I checked from the Google Map.
And if I checked their infrastructure carefully,
maybe I didn't send the email to them.
And in this case, the Operation Applejuice case,
I was mocked by abundant preparation from the Lazarus Group.
They configured the fake website with SSL certificate
and developed a fake cryptocurrency trading application
to deceive the victim.
Actually, they managed the fake company.
Also, they operate a kind of support center.
In another email conversation,
not an initial email,
another email conversation to get an additional application,
they replied to my email with a very nice English.
And despite we made an interesting research
on Operation Applejuice,
I made a hasty decision at the beginning
so that I notified the actor we recognized their campaigns.
Yep, those are the failure cases I would like to share.
The attribution is matter,
but it's very hard
because we need to still rely on the many points for manual jobs.
And as human beings,
we have lots of stereotypes and biases.
So we can easily be compromised by the first flag
and the other things that can affect our decisions.
So we should very carefully bring the conclusions
and judge something after collecting evidence as much as we can.
But I know it's a very challenging process,
but we need to do our best for this.
And sometimes as a threat intelligence analyst,
we need to do our best.
I think it's a kind of responsibility
when we publish something,
especially the attributions,
because it can bring a lot of chaos to our industry.
And the last thing I want to share is a quotation
from the professor Richard Veinman.
He said,
you learn nothing from life
if you think you are right all the time.
So yeah, we should admit we can be wrong.
And sometimes we need to learn from our failures.
I think.
Yep, that's it.
I hope my presentation is useful to someone.
So if you have any questions,
please leave a question on the Blue Team Village Discord channel.
I will get around at that Discord channel
or send your question to my Twitter or email
and I will reply soon.
And thank you for your attention.