All right, so we are going to be starting with our next speakers, Mauro and Juan.
So they will be talking about Riding With The Columus, our 100 days quest to identify a North
Korean state-sponsored threat actor. Now I'll let them take over the stage.
Thanks. We are not so good, come on. Okay, welcome to our talk, Riding With The Columus,
our 100 day quest to identify a North Korean state-sponsored threat actor.
My name is Mauro Eldridge and my partner today is Juan Brotherson.
This talk is divided into three sections. The first, we will have a really brief introduction
about this talk and about ourselves, and about this mysterious war, Colima. Then we will jump
into the technical analysis of this talk, which is called 100 Days In The Labyrinth, which starts
telling... we will get in a minute to the details. And then a wrap-up section called Riding With
The Columus. I know that the titles are a little bit catchy, but believe me, it's worth it.
Let's start with a short intro. My name is Mauro Eldridge, I'm an Argentine hacker,
I'm the founder of Vermican Cyber Arms and DC5411, which is the Defcon group for Argentina
and Uruguay. This is my 10th time at Defcon, and I think it's my fifth time here at the Recon
Village, so I'm very happy to be here today. And my partner is Juan Brotherson,
he's going to introduce himself. Hi, well, I'm not a hacker, I'm a journalist.
This is my laptop, and they were installing something here. I'm kind of frightened,
but they are giving me a good headline. That is, I came to Defcon, I make a coverage,
I give a talk, and I got infected. So that's quite nice, right? So yes, Mauro is going to talk about
the technical side of this malware he found, but I write in a newspaper in Argentina that is
quite big, a media outlet. And of course, because this is my first Defcon, I watch a documentary
that you all know, and there's a quote that sticks in my head that says, from the organizers,
in the 101 talk, remember, the media is not your friend. And I kind of get it, because we don't
have a good reputation, I know that. But my part of the talk is, like, try to explain or show how
we told this story in a newspaper, because all of you know the technical words of these
kind of things, but trying to reverse engineer this idea that we are not your friend,
using your terminology, is what we will try to do together, right?
Thanks. So, this concludes the introduction. We will jump into the two chapters. The first one, I will tell a short story on how a client got infected with something quite weird,
and I found it to be a sample of malware we watched, really unusual, really homemade.
And I still keep to my words today, I still think that it was homemade, it wasn't really something complex.
And it was surprisingly simple and avoided all antivirus detections, all, any vendor you name it,
it bypassed it. It was only detected by the heuristics, so by its behavioral analysis,
and I started conducting some CTI, a no-sint, on the extracted indicators, and things started to
take, like, a little bit twisted turn, something that I wasn't expecting. It was like the real,
Then, when I started to suspect that this was something a little bit bigger, I had to request
certain answers, but nobody, especially companies, corporations, they do not answer, they do not reply
to threat analysts, but they will reply to the journalism. That's when I say, okay, I need a
journalist friend here. That's why we are important, guys. You see, media can be your friend, or an asset,
depending on... So, it took us almost a hundred days. Actually, the title is a hundred days, but it was
two hundred, almost. And we decided to team up with Juan. I started asking the questions around,
people had to give explanations, people had to share intel, and mostly, I knew that we heard
some prides here, but companies had to say, we don't have intel, we don't know, we don't have
anything to say about it, and it's a little bit hard for them to recognize that part, and that
that's one of the best parts of the journalism edition here. We have some new leads at hand
on this chapter, and we make a really strange wrap-up, with a wonderful surprise at the end,
that I hope you enjoy. So, before we start, I want to make clear what's a Colima. I know that
some of you already know, especially those who are from the CrowdStrike team, and some other
doesn't. Let's say in simple words, a Colima or Calima, it's a Pegasus from the Eastern
Asian culture. But, on the CrowdStrike terminology, it refers to state-sponsored actors.
For those who are not familiar, state-sponsored actors are threat actors that commit malicious
and organized activities, backed by their own state. This means basically two things.
The state guarantees you eternal funding, a lot of funding, a lot of money, and you're also
immune. You have a state-provided legal immunity, because the state itself is asking you to commit
crime. So, obviously, this will lead to reckless operations, like the ones that you can see listed
here. So, these reckless operations obviously do not have consequences for them, except that
being reckless sometimes has certain setbacks, like a well-placed threat analyst and a well-timed
journalist that just want to start asking questions around disturbing people.
And so, we started with this. This is the first chapter, and it started in the things from the
start. On February 7th, the malware was deployed and was actually managed to be downloaded and
executed on one of my client's equipment. It was bundled inside a fake QR generator project
written in Java. Actually, the project did work, did generate QR codes, but there was one of the
libraries that was an implant, a Java file that was a standalone implant that started
generating malicious activity. At the time, we only had the behavioral analysis. We didn't have
a name. We didn't have a family. We didn't say, this is Joker Spy. This is Raccoon. We didn't
know what it was. So, luckily, CrowdStrike... we are not affiliated with CrowdStrike, so it's a
good time to say it. CrowdStrike managed to stop it and to network contain the host. So, the host
will not be able to communicate without passing first to CrowdStrike. So, we were able to stop it
in the middle while it was happening. And the artifact had, obviously, as most artifacts, a
self-delete routine, a self-clean routine. But it wasn't able to execute because we blocked it
with Falcon, its ability to delete files. So, we were able to cease the artifact for us. We started
monitoring its behavior. We saw that nothing that we extracted at first sight was being used in
another malware family. And we started extracting the IOCs. So far, this is the first thing that I
wrote on my report. And I keep to my words today to be transparent and intellectually honest. I
wrote that it was really simple and, for me, it was homemade. It was a simple RAT that attempted
to open a reverse shell where the threat actor will manually connect. Nothing is automated here.
It opens the shell. Somebody connects in and starts popping commands at hand. At the time of
writing, there were no mentions. Nobody knew anything about this. So, I named it qrlog because
that was the name the dropper file used, qrlog.java. This is the very first report. I didn't have
anything better to say about it. And to be honest, it was really simple, surprisingly simple. And I
thought it was like a test, like some script kid was trying to do some big heist. But it was
strange to be successful with such a simple malware. qrlog hides in super plain sight.
The input itself only contains a variable which says quite some data. Nothing else.
Written in base64. And its final objective, as you can see on the second picture, is executing
a reverse shell. From that point onwards, everything is manual. Nothing is automated.
Now, the only company that detected the sample was a Vietnamese threat intelligence company
and did not detect the malware itself. It detected the link, the Google Drive link where it was
stored. But nothing else. It doesn't say this file is malicious. It just says something in the zip
file is fishy. So this was the only lead we had. All the other vendors, let me go back a second,
one over 90. All the other vendors said, no, this is fine, just run it.
Now, if you analyze the code, and we will later share all this analysis on GitHub,
you will see that some things are pretty basic, like how it tries to
find the running operating system. It also has different routines to write on different hosts.
The file system varies between Unix and Windows. And then it tries to create a random function
where it also imports two other random libraries, random generators. So this led us to believe that
it was either a copy-pasting or some GPT was involved in the middle. And finally, the C2 server
is published like in Play View. It doesn't use an array of IPs, an array of different
hosts to be bouncing around. It just has a URL.
And these novice errors led to an interesting object file, which I will share in the end.
But here's the point. To be honest, I'm from the Ruby side. I do not write Java code,
so I'm not in the position to judge anyone's code, even from a student. That's when I
resorted to my friend, a journalist, to ask and to find a Java expert.
So here we had the idea to talk to a programmer and give the code.
This is something that gave us a quote that is interesting. Remember, I have to translate
everything to a newspaper audience, right? So this idea that Maxi Feldman is a programmer and author
of many books in programming, and he knows Java very well. So he told us that the malware isn't
so hidden, like in a scale from 1 to 10 is like a 3, he was guessing. And this idea of it's like
if someone had made a script to hug their girlfriend was a very nice picture to explain
the situation. Because in our daily basis, when we talk with Mauro and send jokes and memes and
that kind of thing, he was telling me about this story. And that's the point when I started to
guess, well, this is newsworthy. We can translate it to a general audience to understand what is
happening here, right? So this was like the first step to start to check the information
that Mauro was producing and see if we could come up with a story, right?
A nice way to say that I don't know how to do a hello world in Java, but thanks.
So I was calling it a day. Put yourself in my shoes for a minute. You have a homemade
GIDI product artifact and you say, okay, I just upload it to see if somebody cares in the world.
So I opened OTX. For those who don't know, it's the Open Threat Exchange. It's my personal
favorite platform. And it shows some indicators calling it QR log. And if you can see, it's still
linked to my personal GitHub because I didn't thought that it was something big.
So two days later, I published the write-up, analyzing the code, and I made the intelligence
public through OTX, as I say. And up to this point, I called it a day. And for a long time,
almost two months, nothing else happened. Around the IOCs that we were extracting,
there was nothing really noticeable. There was nothing that actually caught my eye.
The domains using the SSL certificate used by Let's Encrypt, like a lot of others do,
we did this analysis, because it's historical, the host is no longer up, with grabber-app.io,
which I recommend you to try. And one of the... both the domains were burned at infra. So they
were really burned. They were used a lot of time. For example, pxalternet.org points to a vulture
IP, a vulture instance, which has a lot of associations with log-first exploitation,
with cobalt-type usage, with jokers-by-activity, among others. This is just to name some. There
were all sorts of... a total zoo of malware was running on that instance.
And then, the git-hub.me, which is the C2 server, properly said, is now parked,
it wasn't before, on park1, and all traffic is now hosted on Cloudflare. And don't let the names
of the nameservers mislead you. They are based on Brazilian cities, for those who don't know,
but the servers are in Europe, actually. But in the past, if you check previous pulses,
and if you run a query on any... from a ping or whatever, you will see that the host
was pointed to an Amazon AWS instance. And here's the thing. Lots of Intel platforms, like OTX,
if you see, it says, verdict whitelisted, whitelist automatically cloud instances.
This is a really bad practice. Really bad. And we will see why in a minute, from the very mouth
of the AWS chief information security officer. But I'll be there in a minute.
So, I published this, and this domain was actually used for, by more than 500 domains,
and more than 100 unit TLDs. And this indicator, two months later, when this was a dead topic for
me, I was, I don't know, breaking another thing, caught the eye of another researcher who called
me on docs. This researcher called Daniel pointed to me that this issue is part of a DPRK, Democratic
Public of... no, Democratic People's Republic of Korea, or North Korea, infra. He told me,
this IP is a C2 from them. And then, I needed to check this information, because nobody else
knew that information. Nobody else had that intel. And then, was when my friend, a journalist,
came again. This is just like a strike. I went to the AWS summit in Washington, that is, I don't
know if you're aware, but this summit that Amazon, well, AWS holds every year. And when Mauro told
me all of this, because I was covering for journalistic purposes, I told him, well, we
got to go through the CISO and ask about this situation. And I mean, it's... I'm sorry, where
was CrowdStrike? I thought it was AWS. Sorry. This one is the... I have to clear this up, that I have
this in a bar here. We are not affiliated with CrowdStrike, right? And drinking and that, I got
this t-shirt. But Falcon, which is this system that CrowdStrike uses, detected this malicious
activity and related to QR log. And this was the time when we could check that the sample that
Mauro detected was being analyzed by threat intelligence companies, right? And they connected
it with Labyrinth Colima, that the words that they use is height level or height confidence,
because you cannot attribute a hundred percent. But because of the adversary's tactics, techniques
and procedures, they could connect this malware that Mauro detected with Labyrinth Colima. And
this was the piece of information that Mauro wasn't able to get from them. And this was like
the eureka moment, because he told me, oh, that's the name I put to the malware. So yes, we have
this story, right? Yeah, they were using my name and they didn't want to provide me the intel.
I should have sued for copyright. YouTube doesn't have this problem, you know.
Okay, let's get serious. So that's my conversation with Yutok's user, because here the mystery
remains untouched. And I was telling him, you actually left me frozen. I wasn't aware I was
playing with a DPRK sample. And you can see here the intel diagram from CrowdStrike, which attributes
both domains to Labyrinth Colima. Again, with high confidence. Now we were playing with a sample
from a state-sponsored actor. And what's the first thing a responsibility threat
analyst will do? We started playing with the C2, crafting messages to it, trying to interact with
it. And one thing led to another. I'm not the smartest person in the room. For journalistic,
merely journalistic purposes, we started messaging the C2 with crafted payloads, requesting them to
chat with us, to have an interview with us, and sharing our telegram alias. And obviously,
they were not really friendly about it. And during a couple of days,
Keen Boys were trying to brute force our SSH servers from the machine where we tried to
establish the connection. But unbeknownst to them, since we are always one step ahead
of the Keen Boys, that machine was disposable and was full of honeypots. So all they tried,
which was a thousand and a half of attempts, was logged by me and by my honeypot. So this
provided us with a lot of intel again. Somebody's going to die on the DPRK, I know. I can't sleep
thinking about it, man. Fucking comedy night tonight. Okay, what caught my eye here is that
both the domains and the IP addresses were scattered all around the world. Even in my
country, Argentina, Uruguay, Peru, India, you name it, they were all across. And not all of them
were exactly burned infra. Some of them had a good reputation. Yeah, I took the time to
check everyone. I'm not really fun at parties. And most of them belonged to reputable BPS
providers. Once again, including Amazon. So this is where my friend, the journalist, enters again
and say, let's get, let's pick on that guy, the chief information security officer from Amazon.
So as I was telling you before, yes, Mark Ryland, who is the CISO, I got the chance to talk with
him in DC. He was totally aware of the situation. And I'm quoting here, he said, we are aware that
hackers are willing to pay for AWS. And the explanation is simple. He said, someone who
sends spam, for example, can pay a low amount to have a Linux server and send a million phishing
emails, right? I think this would be a problem that not only AWS had, of course, other platforms
too, like Azure and Oracle and those companies. But he acknowledged to be, and I'm quoting,
that we are very concerned about spam coming from the platform because, of course, it lowers
our reputation. It causes problems for legit users that try to connect because they can't send
emails logically. And he also pointed that they have identified that there are more sophisticated
actors that conduct this kind of abuse of the platform, right? I mean, Amazon said that they
would no longer sponsor us. Yes. Okay. And so you are now... we now started to think,
this guy has used some detectable samples, even if they look like toys, distributed botnets,
and they are really, really short fuse with us. But who are the heads, the brains, the masterminds
behind these operations? A quick note, I will share all these indicators too in the GitHub
repository. Don't worry. So this led us to the wrap-up section to try to profile a little bit
what's happening behind the scenes, behind the code, behind the malware, behind the IOCs.
Let me share with you a short, once again based on CrowdStrike, which definitely is not paying us,
a state-sponsored threat landscape from the DPRK. We have two groups that seem to not be exactly
tied. They are state-sponsored, but not exactly tied to an organization, ministry, secretariat,
whatever you call it in your country. There are Velvet Kolyma, which are dedicated to US
and Republic of Korea, South Korea obviously, critical infra, NGOs, government, media, military.
The Ricochet Kolyma, which are based especially on Republic of Korea operations against government,
media, and also DPRK defectors. But we don't have a lot of intel on that part, which is the most
interesting part actually. And then we have the DPRK-RGB, which is the Reconnaissance General
Bureau, which contains the Bureau 121 and 180, which are mostly commonly known by APT38, SYNC,
Hidden Cobra, The Beagle Boys, or the infamous Lazarus. So here we started to gather information.
This is kind of well-known information, because Lazarus is like the most famous
group that Mauro named. But in order to write a news story, we have to tell the public and remember
who is Lazarus and what they're famous for. So we started gathering quotes from researchers,
and this one is from ESET, Latin America. And well, it's something that maybe all of you know,
it's a highly sophisticated cybercriminal group that targets high-profile cyberattacks,
and that they are linked to North Korea. But this is something very interesting,
that they've been active for more than 20 years, right?
And then inside Lazarus, we have three divisions. Once again, remember that all this is kind of a
black box intelligence, let's call it, to give it a name. You don't know for sure,
because you do not work for the DPRK. I promise, I don't work for them. And since you don't work
for them, you are seeing things from the outside, from outside the window. So sometimes assets or
groups may be, let's say, a little bit elastic and work for one or another. They sometimes share
infrastructure, they sometimes share the same arsenals or reuse infra from past operations.
Remember that this has to be taken with a grain of salt. We have CIDR and Colima,
which are dedicated to high-profile corporate and economic espionage,
Stardust and Colima, which are mostly focused on high-profile heists, especially for cryptocurrency
and in the past for the banking system, and the Labyrinth and Colima, which are more generally
some broader group dedicated to currency theft and corporate espionage, but even on lower levels,
not only high-profile. They are the responsible for QR log. This is what CrowdStrike have to say
about it. Yes, what's interesting about this slide is that Sony incident, WannaCry, are those cases
that actually hit headlines, right? That were in the newspapers. They like jumped the niche of
cybersecurity, right? So again, speaking to CrowdStrike, they assess that they are linked
to the Bureau 121 of the RGB, and they're conducing espionage actions and revenue generation
schemes, and that they do intelligence gathering, but also a financial gain. That is what interests
us the most, because this QR was designed to extract or rob, yes, cryptocurrency money, and
destruction and intellectual property theft. So with these quotes, we started like to,
in the article, to make the context, right? To remember the audience what all of this means.
And as I was saying, the Sony picture tax was very well known because they leaked movies that
weren't released, right? And that was something that hit very heavy on the headlines, right?
And the other piece of information that we used as context was the AstraZeneca
case that they did spear phishing to try to steal intellectual property. They didn't
succeed in the attack, but it really, it was in the headlines also, right?
So with all of this, there was a CrowdStrike report, not the quotes that they gave us to me,
but there was a previous report about Labyrinth Colima that says that the stolen assets that we
are describing are, I'm quoting, likely funding an array of state projects, including their nuclear
and weapons of mass destruction programs. And this sounds kind of crazy, right?
But I started gathering information about this, and there is a quote on Kim Jong-un,
the North Korean leader. I think we're going to have to cancel the trip to North Korea
afterwards. Yes, yes, yes. Does this go online or the talk?
But there's a quote that is very interesting, again, for a general audience that says that
civil warfare is an all-purpose war that guarantees the North Korean people's armed force,
ruthless striking capabilities, along with nuclear weapons and missiles. So Kim himself is kind of
giving us some hints about this piece of information. Actually, the Treasury of the
United States took action against North Korean hacking groups because they identified that they
were perpetrating cyber attacks to support these missile programs, right?
So, as you might know, they are organizing as an APT in order to steal currency,
primarily from banks, now they are moving into the crypto world, to finance a ballistic program.
That's no small deal. But sometimes, and this is a wonderful surprise I have for you,
sometimes these large organizations like the APTs, government agencies, secretariats,
whatever you call it, have a little bit of a hard time managing their assets,
both the technological and the human ones. Sometimes, object fails happen, like this one.
On the sample that I have collected, that I had seized, the file inputfiles.lst, for all those
who use Java and Maven, you maybe already know what's going to happen, contains Maven building
information. So, based on it, it's possible to ascertain that the author of the malware
operates on Windows, and it's called Edward. So, Edward, I know what you did there,
you did it right, using Western technology, you traitor of the DPRK.
So, let's do a quick wrap-up about this talk, and we will jump to our conclusions,
which are more like tips on lessons learned, as you want to call it.
So, the idea is how to make a headline out of this. I know this is Spanish, but it's saying,
made in North Korea, they found a virus that works like a digital model of... and I know you
don't like these headlines, guys, but how do you explain to someone that there is a malware that
it's shitty written, sorry, but as Mauro says, it's not well written, it's like something that
is not professional, but it's effective, it's not detected by the heuristics,
and that kind of thing. So, I write for a newspaper that has this number of print units
every day, and these subscriptions, and that's the average age of the readers,
so that's something you have to consider. And the big question is, how do we tell the story
to my mother, my girlfriend, my sister, my friends, because that's the whole point of it.
You hackers are providing incredible, useful insights, and there is, in Argentina, at least,
I know, like, for example, here in the States, you have lots of good people that are covering
this beat, and it's amazing that that's happened, but in Argentina, we don't have that tradition.
We don't have the InfoSec beat covered, right? So, when I try to write this down,
I try to think in these three keys, right? First, to translate. You all know, or some of you know,
what a RAT is, what an IOC is, what an APT is. I know all of this because I talked to him, right?
And after talking to him, I started reading, and I started researching, and gathering information,
reading reports from lots of companies that does Intel, not only CrowdStrike, but also Checkpoint,
ESET, Palo Alto, all of those companies make very insightful reports that are very useful.
And the challenge is to translate all of this, right? When we were talking about the RAT,
he was saying, it's like if the attacker is in front of your computer without being there. Well,
that's a good explanation, right? So, a malware, it's a virus. I mean, you could kill me because of this,
but in order to explain this to a general audience, you have to make some sacrifices.
Then in the article, when you're writing, okay, you can use parentheses, commas, and make explanation,
there's no problem with that, respecting the journalistic guidelines, right? But this is a
work we have to do in the media. We have to assess this kind of work, right? The second key aspect
to me is to give voice to specialists, to hackers, to investigators, to researchers. So that's why we
got in touch with a hardware expert, a malware analyst, and a threat analysis, and these kind of things.
And the other pillar to me is to explain to the audience why this is important. Why does
this matter, right? So one thing we were talking not only with Mauro, but other Argentine hackers
here, is that this is like the most asked question. When I came here and I started saying in my circles
I'm going to DEF CON, oh, what is DEF CON? No, a hacker convention. They told me, what? There's a hacker
convention? Is that even legal? Yes, and it's a problem, because I know all of you are very familiar
with this problem, but I think the point is to understand that this question on the left
is not useful. I mean, why do people keep asking this question? So I think that the journalistic
challenge is to shift that question towards how is this intel that you guys are providing
changing the information about the world and how we know it? Because the global landscape
is changing and it's changing really, really fast, right? So the whole point of publishing these
stories that, believe me, I have the freedom to publish like anything in my bit, in my section,
in my newspaper, problem is you don't get many users, clicks and that kind of things, right? So that's
why you have to make a headline like that with a molotov and that kind of things to catch the eye
and then explain like the technical things and try to translate. But for me, the most important thing
of the Mauro's investigation was that we could carry out that to a media outlet that is huge and
is not used to treat these topics, right? So I would like, I was telling Mauro, thinking that
this question is the question that you guys are answering, right? And that deserves a spot in the
media and someone that can translate that kind of language, right? And now your grandma fears Kim Jong-un.
Cool. So our conclusions or lessons learned from things is that any suspicious activity you find,
even the smaller one, regardless of its scale, should be investigated to the last consequences.
I got a lot of people telling me to drop it off. It was not worth it. And I only stopped
investigating it when I thought myself that it wasn't worth it. But some people even from minute
zero say, no, it's not worth it. Allow it to pass. And you don't do it, especially those folks that
work in socks. You know that you don't let almost anything pass. You have to be wary of almost
anything. Also always share the intel. If I wasn't in the first place sharing the intel, even if I
thought that it wasn't worth it, I would have never known that I was playing with a DPRK sample.
And always ask the questions. Maybe you can find someone who is asking the same question as you
or that has the answer. And media sometimes can be your friend or an asset. And if you want to check
the QR log technical analysis and all the IOCs, I'm going to publish the repository in five minutes.
I was just finished cleaning it up. I want to be honest, I still can't finish it. It is there.
I moved it from my company, Handler, not on Mauro Eldridge. And also if you want to see,
again, as he says, Labyrinth Colima tends to hit the headlines.
The story was covered on Clarín, Argentina's top newspaper. So you have the link there.
We will also share the slides in case you want to copy the link on a more
comfortable way. And we need to recognize the help from a lot of people who, without them,
this talk wouldn't be possible. Maxi Fehrman for aiding with the sample analysis. Daniel,
Merlo, Croucher, AWS, and ESET for their insight. And my folks at the DC5411 and Birmingham Cyberarms.
I think I'm not forgetting anyone. Oh, and Edward for providing the sample and giving us one of the
most enjoyable jobs we've ever done. Thank you. You have been an amazing panel.