[00:00.000 --> 00:06.840]  All right, so we are going to be starting with our next speakers, Mauro and Juan.
[00:06.840 --> 00:12.500]  So they will be talking about Riding With The Columus, our 100 days quest to identify a North
[00:12.500 --> 00:17.740]  Korean state-sponsored threat actor. Now I'll let them take over the stage.
[00:19.920 --> 00:30.840]  Thanks. We are not so good, come on. Okay, welcome to our talk, Riding With The Columus,
[00:30.840 --> 00:34.900]  our 100 day quest to identify a North Korean state-sponsored threat actor.
[00:34.900 --> 00:38.020]  My name is Mauro Eldridge and my partner today is Juan Brotherson.
[00:38.360 --> 00:43.980]  This talk is divided into three sections. The first, we will have a really brief introduction
[00:43.980 --> 00:49.700]  about this talk and about ourselves, and about this mysterious war, Colima. Then we will jump
[00:49.700 --> 00:57.980]  into the technical analysis of this talk, which is called 100 Days In The Labyrinth, which starts
[00:58.700 --> 01:03.640]  telling... we will get in a minute to the details. And then a wrap-up section called Riding With
[01:03.640 --> 01:09.560]  The Columus. I know that the titles are a little bit catchy, but believe me, it's worth it.
[01:10.580 --> 01:14.860]  Let's start with a short intro. My name is Mauro Eldridge, I'm an Argentine hacker,
[01:14.860 --> 01:19.520]  I'm the founder of Vermican Cyber Arms and DC5411, which is the Defcon group for Argentina
[01:19.520 --> 01:24.540]  and Uruguay. This is my 10th time at Defcon, and I think it's my fifth time here at the Recon
[01:24.540 --> 01:28.520]  Village, so I'm very happy to be here today. And my partner is Juan Brotherson,
[01:28.520 --> 01:32.940]  he's going to introduce himself. Hi, well, I'm not a hacker, I'm a journalist.
[01:34.240 --> 01:39.700]  This is my laptop, and they were installing something here. I'm kind of frightened,
[01:39.700 --> 01:44.340]  but they are giving me a good headline. That is, I came to Defcon, I make a coverage,
[01:44.340 --> 01:50.780]  I give a talk, and I got infected. So that's quite nice, right? So yes, Mauro is going to talk about
[01:50.780 --> 01:57.380]  the technical side of this malware he found, but I write in a newspaper in Argentina that is
[01:57.380 --> 02:05.040]  quite big, a media outlet. And of course, because this is my first Defcon, I watch a documentary
[02:05.040 --> 02:12.860]  that you all know, and there's a quote that sticks in my head that says, from the organizers,
[02:12.860 --> 02:18.900]  in the 101 talk, remember, the media is not your friend. And I kind of get it, because we don't
[02:18.900 --> 02:26.740]  have a good reputation, I know that. But my part of the talk is, like, try to explain or show how
[02:26.740 --> 02:33.640]  we told this story in a newspaper, because all of you know the technical words of these
[02:34.260 --> 02:40.580]  kind of things, but trying to reverse engineer this idea that we are not your friend,
[02:40.580 --> 02:46.140]  using your terminology, is what we will try to do together, right?
[02:47.280 --> 02:59.580]  Thanks. So, this concludes the introduction. We will jump into the two chapters. The first one, I will tell a short story on how a client got infected with something quite weird,
[03:00.280 --> 03:05.620]  and I found it to be a sample of malware we watched, really unusual, really homemade.
[03:05.840 --> 03:11.140]  And I still keep to my words today, I still think that it was homemade, it wasn't really something complex.
[03:11.140 --> 03:18.240]  And it was surprisingly simple and avoided all antivirus detections, all, any vendor you name it,
[03:18.240 --> 03:25.160]  it bypassed it. It was only detected by the heuristics, so by its behavioral analysis,
[03:25.160 --> 03:31.100]  and I started conducting some CTI, a no-sint, on the extracted indicators, and things started to
[03:31.100 --> 03:41.120]  take, like, a little bit twisted turn, something that I wasn't expecting. It was like the real,
[03:41.800 --> 03:47.600]  Then, when I started to suspect that this was something a little bit bigger, I had to request
[03:47.600 --> 03:54.560]  certain answers, but nobody, especially companies, corporations, they do not answer, they do not reply
[03:54.560 --> 04:02.160]  to threat analysts, but they will reply to the journalism. That's when I say, okay, I need a
[04:02.160 --> 04:07.580]  journalist friend here. That's why we are important, guys. You see, media can be your friend, or an asset,
[04:07.580 --> 04:17.820]  depending on... So, it took us almost a hundred days. Actually, the title is a hundred days, but it was
[04:17.820 --> 04:22.960]  two hundred, almost. And we decided to team up with Juan. I started asking the questions around,
[04:22.960 --> 04:28.740]  people had to give explanations, people had to share intel, and mostly, I knew that we heard
[04:28.740 --> 04:32.960]  some prides here, but companies had to say, we don't have intel, we don't know, we don't have
[04:32.960 --> 04:37.440]  anything to say about it, and it's a little bit hard for them to recognize that part, and that
[04:38.280 --> 04:43.840]  that's one of the best parts of the journalism edition here. We have some new leads at hand
[04:43.840 --> 04:49.760]  on this chapter, and we make a really strange wrap-up, with a wonderful surprise at the end,
[04:49.760 --> 04:55.800]  that I hope you enjoy. So, before we start, I want to make clear what's a Colima. I know that
[04:55.800 --> 05:00.480]  some of you already know, especially those who are from the CrowdStrike team, and some other
[05:00.480 --> 05:07.300]  doesn't. Let's say in simple words, a Colima or Calima, it's a Pegasus from the Eastern
[05:07.300 --> 05:14.100]  Asian culture. But, on the CrowdStrike terminology, it refers to state-sponsored actors.
[05:14.100 --> 05:19.500]  For those who are not familiar, state-sponsored actors are threat actors that commit malicious
[05:19.500 --> 05:25.180]  and organized activities, backed by their own state. This means basically two things.
[05:25.180 --> 05:31.620]  The state guarantees you eternal funding, a lot of funding, a lot of money, and you're also
[05:31.620 --> 05:36.600]  immune. You have a state-provided legal immunity, because the state itself is asking you to commit
[05:36.600 --> 05:41.940]  crime. So, obviously, this will lead to reckless operations, like the ones that you can see listed
[05:41.940 --> 05:49.820]  here. So, these reckless operations obviously do not have consequences for them, except that
[05:49.820 --> 05:55.940]  being reckless sometimes has certain setbacks, like a well-placed threat analyst and a well-timed
[05:55.940 --> 06:00.460]  journalist that just want to start asking questions around disturbing people.
[06:01.040 --> 06:05.280]  And so, we started with this. This is the first chapter, and it started in the things from the
[06:05.280 --> 06:13.480]  start. On February 7th, the malware was deployed and was actually managed to be downloaded and
[06:13.480 --> 06:20.720]  executed on one of my client's equipment. It was bundled inside a fake QR generator project
[06:20.720 --> 06:30.100]  written in Java. Actually, the project did work, did generate QR codes, but there was one of the
[06:30.100 --> 06:35.660]  libraries that was an implant, a Java file that was a standalone implant that started
[06:36.440 --> 06:41.700]  generating malicious activity. At the time, we only had the behavioral analysis. We didn't have
[06:42.400 --> 06:47.300]  a name. We didn't have a family. We didn't say, this is Joker Spy. This is Raccoon. We didn't
[06:47.300 --> 06:54.320]  know what it was. So, luckily, CrowdStrike... we are not affiliated with CrowdStrike, so it's a
[06:54.320 --> 07:02.200]  good time to say it. CrowdStrike managed to stop it and to network contain the host. So, the host
[07:02.200 --> 07:10.140]  will not be able to communicate without passing first to CrowdStrike. So, we were able to stop it
[07:10.140 --> 07:16.840]  in the middle while it was happening. And the artifact had, obviously, as most artifacts, a
[07:16.840 --> 07:22.680]  self-delete routine, a self-clean routine. But it wasn't able to execute because we blocked it
[07:22.680 --> 07:30.060]  with Falcon, its ability to delete files. So, we were able to cease the artifact for us. We started
[07:30.060 --> 07:36.520]  monitoring its behavior. We saw that nothing that we extracted at first sight was being used in
[07:36.520 --> 07:44.220]  another malware family. And we started extracting the IOCs. So far, this is the first thing that I
[07:44.220 --> 07:50.060]  wrote on my report. And I keep to my words today to be transparent and intellectually honest. I
[07:50.060 --> 07:56.340]  wrote that it was really simple and, for me, it was homemade. It was a simple RAT that attempted
[07:56.340 --> 08:02.240]  to open a reverse shell where the threat actor will manually connect. Nothing is automated here.
[08:02.240 --> 08:08.400]  It opens the shell. Somebody connects in and starts popping commands at hand. At the time of
[08:08.400 --> 08:13.860]  writing, there were no mentions. Nobody knew anything about this. So, I named it qrlog because
[08:13.860 --> 08:19.700]  that was the name the dropper file used, qrlog.java. This is the very first report. I didn't have
[08:19.700 --> 08:27.200]  anything better to say about it. And to be honest, it was really simple, surprisingly simple. And I
[08:27.200 --> 08:34.980]  thought it was like a test, like some script kid was trying to do some big heist. But it was
[08:35.520 --> 08:42.260]  strange to be successful with such a simple malware. qrlog hides in super plain sight.
[08:42.260 --> 08:46.740]  The input itself only contains a variable which says quite some data. Nothing else.
[08:46.740 --> 08:54.160]  Written in base64. And its final objective, as you can see on the second picture, is executing
[08:54.720 --> 09:00.480]  a reverse shell. From that point onwards, everything is manual. Nothing is automated.
[09:01.420 --> 09:08.420]  Now, the only company that detected the sample was a Vietnamese threat intelligence company
[09:08.940 --> 09:13.780]  and did not detect the malware itself. It detected the link, the Google Drive link where it was
[09:13.780 --> 09:20.060]  stored. But nothing else. It doesn't say this file is malicious. It just says something in the zip
[09:20.060 --> 09:27.260]  file is fishy. So this was the only lead we had. All the other vendors, let me go back a second,
[09:27.260 --> 09:31.640]  one over 90. All the other vendors said, no, this is fine, just run it.
[09:32.500 --> 09:39.680]  Now, if you analyze the code, and we will later share all this analysis on GitHub,
[09:39.680 --> 09:42.760]  you will see that some things are pretty basic, like how it tries to
[09:43.680 --> 09:49.920]  find the running operating system. It also has different routines to write on different hosts.
[09:50.360 --> 09:57.700]  The file system varies between Unix and Windows. And then it tries to create a random function
[09:57.700 --> 10:03.520]  where it also imports two other random libraries, random generators. So this led us to believe that
[10:03.520 --> 10:10.660]  it was either a copy-pasting or some GPT was involved in the middle. And finally, the C2 server
[10:10.660 --> 10:15.340]  is published like in Play View. It doesn't use an array of IPs, an array of different
[10:15.340 --> 10:19.260]  hosts to be bouncing around. It just has a URL.
[10:19.980 --> 10:27.200]  And these novice errors led to an interesting object file, which I will share in the end.
[10:28.500 --> 10:33.980]  But here's the point. To be honest, I'm from the Ruby side. I do not write Java code,
[10:33.980 --> 10:39.420]  so I'm not in the position to judge anyone's code, even from a student. That's when I
[10:40.800 --> 10:44.220]  resorted to my friend, a journalist, to ask and to find a Java expert.
[10:44.220 --> 10:48.280]  So here we had the idea to talk to a programmer and give the code.
[10:48.720 --> 10:54.740]  This is something that gave us a quote that is interesting. Remember, I have to translate
[10:54.740 --> 11:01.420]  everything to a newspaper audience, right? So this idea that Maxi Feldman is a programmer and author
[11:01.420 --> 11:08.840]  of many books in programming, and he knows Java very well. So he told us that the malware isn't
[11:08.840 --> 11:14.920]  so hidden, like in a scale from 1 to 10 is like a 3, he was guessing. And this idea of it's like
[11:14.920 --> 11:22.300]  if someone had made a script to hug their girlfriend was a very nice picture to explain
[11:22.300 --> 11:28.560]  the situation. Because in our daily basis, when we talk with Mauro and send jokes and memes and
[11:28.560 --> 11:37.140]  that kind of thing, he was telling me about this story. And that's the point when I started to
[11:37.140 --> 11:42.040]  guess, well, this is newsworthy. We can translate it to a general audience to understand what is
[11:42.040 --> 11:47.560]  happening here, right? So this was like the first step to start to check the information
[11:47.560 --> 11:53.900]  that Mauro was producing and see if we could come up with a story, right?
[11:54.760 --> 11:59.400]  A nice way to say that I don't know how to do a hello world in Java, but thanks.
[12:00.660 --> 12:06.500]  So I was calling it a day. Put yourself in my shoes for a minute. You have a homemade
[12:07.300 --> 12:13.600]  GIDI product artifact and you say, okay, I just upload it to see if somebody cares in the world.
[12:13.600 --> 12:18.340]  So I opened OTX. For those who don't know, it's the Open Threat Exchange. It's my personal
[12:18.340 --> 12:24.120]  favorite platform. And it shows some indicators calling it QR log. And if you can see, it's still
[12:24.120 --> 12:28.620]  linked to my personal GitHub because I didn't thought that it was something big.
[12:29.200 --> 12:35.040]  So two days later, I published the write-up, analyzing the code, and I made the intelligence
[12:35.040 --> 12:42.040]  public through OTX, as I say. And up to this point, I called it a day. And for a long time,
[12:42.040 --> 12:47.100]  almost two months, nothing else happened. Around the IOCs that we were extracting,
[12:48.020 --> 12:54.340]  there was nothing really noticeable. There was nothing that actually caught my eye.
[12:54.680 --> 13:00.520]  The domains using the SSL certificate used by Let's Encrypt, like a lot of others do,
[13:00.520 --> 13:06.060]  we did this analysis, because it's historical, the host is no longer up, with grabber-app.io,
[13:06.060 --> 13:12.260]  which I recommend you to try. And one of the... both the domains were burned at infra. So they
[13:12.260 --> 13:18.260]  were really burned. They were used a lot of time. For example, pxalternet.org points to a vulture
[13:18.260 --> 13:23.660]  IP, a vulture instance, which has a lot of associations with log-first exploitation,
[13:23.660 --> 13:28.980]  with cobalt-type usage, with jokers-by-activity, among others. This is just to name some. There
[13:28.980 --> 13:35.440]  were all sorts of... a total zoo of malware was running on that instance.
[13:35.880 --> 13:43.260]  And then, the git-hub.me, which is the C2 server, properly said, is now parked,
[13:43.260 --> 13:50.820]  it wasn't before, on park1, and all traffic is now hosted on Cloudflare. And don't let the names
[13:50.820 --> 13:56.420]  of the nameservers mislead you. They are based on Brazilian cities, for those who don't know,
[13:56.420 --> 14:02.960]  but the servers are in Europe, actually. But in the past, if you check previous pulses,
[14:03.960 --> 14:10.780]  and if you run a query on any... from a ping or whatever, you will see that the host
[14:11.540 --> 14:20.360]  was pointed to an Amazon AWS instance. And here's the thing. Lots of Intel platforms, like OTX,
[14:20.360 --> 14:25.200]  if you see, it says, verdict whitelisted, whitelist automatically cloud instances.
[14:25.200 --> 14:30.820]  This is a really bad practice. Really bad. And we will see why in a minute, from the very mouth
[14:30.820 --> 14:36.820]  of the AWS chief information security officer. But I'll be there in a minute.
[14:36.880 --> 14:43.460]  So, I published this, and this domain was actually used for, by more than 500 domains,
[14:43.460 --> 14:49.860]  and more than 100 unit TLDs. And this indicator, two months later, when this was a dead topic for
[14:49.860 --> 14:56.120]  me, I was, I don't know, breaking another thing, caught the eye of another researcher who called
[14:56.120 --> 15:05.040]  me on docs. This researcher called Daniel pointed to me that this issue is part of a DPRK, Democratic
[15:05.040 --> 15:12.680]  Public of... no, Democratic People's Republic of Korea, or North Korea, infra. He told me,
[15:12.680 --> 15:18.480]  this IP is a C2 from them. And then, I needed to check this information, because nobody else
[15:18.480 --> 15:24.260]  knew that information. Nobody else had that intel. And then, was when my friend, a journalist,
[15:24.260 --> 15:30.420]  came again. This is just like a strike. I went to the AWS summit in Washington, that is, I don't
[15:30.420 --> 15:38.520]  know if you're aware, but this summit that Amazon, well, AWS holds every year. And when Mauro told
[15:38.520 --> 15:43.200]  me all of this, because I was covering for journalistic purposes, I told him, well, we
[15:43.200 --> 15:49.140]  got to go through the CISO and ask about this situation. And I mean, it's... I'm sorry, where
[15:49.140 --> 15:57.580]  was CrowdStrike? I thought it was AWS. Sorry. This one is the... I have to clear this up, that I have
[15:57.580 --> 16:03.920]  this in a bar here. We are not affiliated with CrowdStrike, right? And drinking and that, I got
[16:03.920 --> 16:12.520]  this t-shirt. But Falcon, which is this system that CrowdStrike uses, detected this malicious
[16:12.520 --> 16:19.640]  activity and related to QR log. And this was the time when we could check that the sample that
[16:19.640 --> 16:25.520]  Mauro detected was being analyzed by threat intelligence companies, right? And they connected
[16:25.520 --> 16:31.520]  it with Labyrinth Colima, that the words that they use is height level or height confidence,
[16:31.520 --> 16:36.980]  because you cannot attribute a hundred percent. But because of the adversary's tactics, techniques
[16:36.980 --> 16:42.140]  and procedures, they could connect this malware that Mauro detected with Labyrinth Colima. And
[16:42.140 --> 16:47.400]  this was the piece of information that Mauro wasn't able to get from them. And this was like
[16:47.400 --> 16:52.300]  the eureka moment, because he told me, oh, that's the name I put to the malware. So yes, we have
[16:52.300 --> 16:57.100]  this story, right? Yeah, they were using my name and they didn't want to provide me the intel.
[16:58.480 --> 17:03.740]  I should have sued for copyright. YouTube doesn't have this problem, you know.
[17:04.640 --> 17:10.400]  Okay, let's get serious. So that's my conversation with Yutok's user, because here the mystery
[17:10.400 --> 17:16.600]  remains untouched. And I was telling him, you actually left me frozen. I wasn't aware I was
[17:16.600 --> 17:22.740]  playing with a DPRK sample. And you can see here the intel diagram from CrowdStrike, which attributes
[17:23.380 --> 17:31.340]  both domains to Labyrinth Colima. Again, with high confidence. Now we were playing with a sample
[17:31.340 --> 17:35.760]  from a state-sponsored actor. And what's the first thing a responsibility threat
[17:35.760 --> 17:41.100]  analyst will do? We started playing with the C2, crafting messages to it, trying to interact with
[17:41.100 --> 17:48.120]  it. And one thing led to another. I'm not the smartest person in the room. For journalistic,
[17:48.120 --> 17:53.660]  merely journalistic purposes, we started messaging the C2 with crafted payloads, requesting them to
[17:53.660 --> 17:58.680]  chat with us, to have an interview with us, and sharing our telegram alias. And obviously,
[17:58.680 --> 18:07.480]  they were not really friendly about it. And during a couple of days,
[18:07.480 --> 18:13.020]  Keen Boys were trying to brute force our SSH servers from the machine where we tried to
[18:13.020 --> 18:18.960]  establish the connection. But unbeknownst to them, since we are always one step ahead
[18:18.960 --> 18:24.000]  of the Keen Boys, that machine was disposable and was full of honeypots. So all they tried,
[18:24.000 --> 18:30.240]  which was a thousand and a half of attempts, was logged by me and by my honeypot. So this
[18:30.240 --> 18:37.100]  provided us with a lot of intel again. Somebody's going to die on the DPRK, I know. I can't sleep
[18:37.100 --> 18:49.240]  thinking about it, man. Fucking comedy night tonight. Okay, what caught my eye here is that
[18:49.240 --> 18:53.520]  both the domains and the IP addresses were scattered all around the world. Even in my
[18:53.520 --> 19:00.060]  country, Argentina, Uruguay, Peru, India, you name it, they were all across. And not all of them
[19:00.060 --> 19:04.980]  were exactly burned infra. Some of them had a good reputation. Yeah, I took the time to
[19:04.980 --> 19:12.060]  check everyone. I'm not really fun at parties. And most of them belonged to reputable BPS
[19:12.060 --> 19:18.040]  providers. Once again, including Amazon. So this is where my friend, the journalist, enters again
[19:18.040 --> 19:24.120]  and say, let's get, let's pick on that guy, the chief information security officer from Amazon.
[19:24.460 --> 19:30.360]  So as I was telling you before, yes, Mark Ryland, who is the CISO, I got the chance to talk with
[19:30.360 --> 19:37.200]  him in DC. He was totally aware of the situation. And I'm quoting here, he said, we are aware that
[19:37.200 --> 19:41.860]  hackers are willing to pay for AWS. And the explanation is simple. He said, someone who
[19:41.860 --> 19:47.040]  sends spam, for example, can pay a low amount to have a Linux server and send a million phishing
[19:47.040 --> 19:52.740]  emails, right? I think this would be a problem that not only AWS had, of course, other platforms
[19:52.740 --> 19:58.820]  too, like Azure and Oracle and those companies. But he acknowledged to be, and I'm quoting,
[19:58.820 --> 20:03.280]  that we are very concerned about spam coming from the platform because, of course, it lowers
[20:03.280 --> 20:08.120]  our reputation. It causes problems for legit users that try to connect because they can't send
[20:08.120 --> 20:14.200]  emails logically. And he also pointed that they have identified that there are more sophisticated
[20:14.200 --> 20:23.260]  actors that conduct this kind of abuse of the platform, right? I mean, Amazon said that they
[20:23.260 --> 20:30.980]  would no longer sponsor us. Yes. Okay. And so you are now... we now started to think,
[20:30.980 --> 20:37.000]  this guy has used some detectable samples, even if they look like toys, distributed botnets,
[20:37.000 --> 20:43.940]  and they are really, really short fuse with us. But who are the heads, the brains, the masterminds
[20:43.940 --> 20:51.240]  behind these operations? A quick note, I will share all these indicators too in the GitHub
[20:51.240 --> 20:56.880]  repository. Don't worry. So this led us to the wrap-up section to try to profile a little bit
[20:56.880 --> 21:01.780]  what's happening behind the scenes, behind the code, behind the malware, behind the IOCs.
[21:01.780 --> 21:07.440]  Let me share with you a short, once again based on CrowdStrike, which definitely is not paying us,
[21:07.580 --> 21:13.580]  a state-sponsored threat landscape from the DPRK. We have two groups that seem to not be exactly
[21:13.580 --> 21:19.900]  tied. They are state-sponsored, but not exactly tied to an organization, ministry, secretariat,
[21:19.900 --> 21:25.560]  whatever you call it in your country. There are Velvet Kolyma, which are dedicated to US
[21:25.560 --> 21:32.880]  and Republic of Korea, South Korea obviously, critical infra, NGOs, government, media, military.
[21:32.880 --> 21:40.060]  The Ricochet Kolyma, which are based especially on Republic of Korea operations against government,
[21:40.060 --> 21:46.100]  media, and also DPRK defectors. But we don't have a lot of intel on that part, which is the most
[21:46.100 --> 21:50.860]  interesting part actually. And then we have the DPRK-RGB, which is the Reconnaissance General
[21:50.860 --> 22:02.360]  Bureau, which contains the Bureau 121 and 180, which are mostly commonly known by APT38, SYNC,
[22:02.360 --> 22:10.560]  Hidden Cobra, The Beagle Boys, or the infamous Lazarus. So here we started to gather information.
[22:10.560 --> 22:15.660]  This is kind of well-known information, because Lazarus is like the most famous
[22:17.000 --> 22:25.020]  group that Mauro named. But in order to write a news story, we have to tell the public and remember
[22:25.020 --> 22:31.060]  who is Lazarus and what they're famous for. So we started gathering quotes from researchers,
[22:31.060 --> 22:36.200]  and this one is from ESET, Latin America. And well, it's something that maybe all of you know,
[22:36.200 --> 22:42.920]  it's a highly sophisticated cybercriminal group that targets high-profile cyberattacks,
[22:42.920 --> 22:49.300]  and that they are linked to North Korea. But this is something very interesting,
[22:49.300 --> 22:52.200]  that they've been active for more than 20 years, right?
[22:54.540 --> 23:00.960]  And then inside Lazarus, we have three divisions. Once again, remember that all this is kind of a
[23:00.960 --> 23:05.000]  black box intelligence, let's call it, to give it a name. You don't know for sure,
[23:05.000 --> 23:11.000]  because you do not work for the DPRK. I promise, I don't work for them. And since you don't work
[23:11.000 --> 23:15.380]  for them, you are seeing things from the outside, from outside the window. So sometimes assets or
[23:15.380 --> 23:21.640]  groups may be, let's say, a little bit elastic and work for one or another. They sometimes share
[23:21.640 --> 23:30.840]  infrastructure, they sometimes share the same arsenals or reuse infra from past operations.
[23:30.840 --> 23:35.740]  Remember that this has to be taken with a grain of salt. We have CIDR and Colima,
[23:35.740 --> 23:39.520]  which are dedicated to high-profile corporate and economic espionage,
[23:39.520 --> 23:46.200]  Stardust and Colima, which are mostly focused on high-profile heists, especially for cryptocurrency
[23:46.200 --> 23:51.320]  and in the past for the banking system, and the Labyrinth and Colima, which are more generally
[23:51.320 --> 23:57.900]  some broader group dedicated to currency theft and corporate espionage, but even on lower levels,
[23:57.900 --> 24:03.780]  not only high-profile. They are the responsible for QR log. This is what CrowdStrike have to say
[24:03.780 --> 24:10.220]  about it. Yes, what's interesting about this slide is that Sony incident, WannaCry, are those cases
[24:10.220 --> 24:15.840]  that actually hit headlines, right? That were in the newspapers. They like jumped the niche of
[24:15.840 --> 24:22.280]  cybersecurity, right? So again, speaking to CrowdStrike, they assess that they are linked
[24:22.280 --> 24:28.900]  to the Bureau 121 of the RGB, and they're conducing espionage actions and revenue generation
[24:28.900 --> 24:37.140]  schemes, and that they do intelligence gathering, but also a financial gain. That is what interests
[24:37.140 --> 24:46.200]  us the most, because this QR was designed to extract or rob, yes, cryptocurrency money, and
[24:46.200 --> 24:54.400]  destruction and intellectual property theft. So with these quotes, we started like to,
[24:54.400 --> 25:01.860]  in the article, to make the context, right? To remember the audience what all of this means.
[25:01.860 --> 25:07.160]  And as I was saying, the Sony picture tax was very well known because they leaked movies that
[25:07.160 --> 25:14.640]  weren't released, right? And that was something that hit very heavy on the headlines, right?
[25:14.640 --> 25:21.180]  And the other piece of information that we used as context was the AstraZeneca
[25:22.720 --> 25:30.120]  case that they did spear phishing to try to steal intellectual property. They didn't
[25:30.720 --> 25:35.340]  succeed in the attack, but it really, it was in the headlines also, right?
[25:35.340 --> 25:45.720]  So with all of this, there was a CrowdStrike report, not the quotes that they gave us to me,
[25:45.720 --> 25:52.200]  but there was a previous report about Labyrinth Colima that says that the stolen assets that we
[25:52.200 --> 25:58.400]  are describing are, I'm quoting, likely funding an array of state projects, including their nuclear
[25:58.400 --> 26:04.700]  and weapons of mass destruction programs. And this sounds kind of crazy, right?
[26:05.700 --> 26:13.140]  But I started gathering information about this, and there is a quote on Kim Jong-un,
[26:13.140 --> 26:18.520]  the North Korean leader. I think we're going to have to cancel the trip to North Korea
[26:19.140 --> 26:24.160]  afterwards. Yes, yes, yes. Does this go online or the talk?
[26:26.140 --> 26:30.880]  But there's a quote that is very interesting, again, for a general audience that says that
[26:30.880 --> 26:35.660]  civil warfare is an all-purpose war that guarantees the North Korean people's armed force,
[26:35.660 --> 26:41.660]  ruthless striking capabilities, along with nuclear weapons and missiles. So Kim himself is kind of
[26:41.660 --> 26:46.540]  giving us some hints about this piece of information. Actually, the Treasury of the
[26:46.540 --> 26:53.440]  United States took action against North Korean hacking groups because they identified that they
[26:53.440 --> 26:59.500]  were perpetrating cyber attacks to support these missile programs, right?
[27:01.700 --> 27:10.120]  So, as you might know, they are organizing as an APT in order to steal currency,
[27:10.120 --> 27:15.280]  primarily from banks, now they are moving into the crypto world, to finance a ballistic program.
[27:15.280 --> 27:20.820]  That's no small deal. But sometimes, and this is a wonderful surprise I have for you,
[27:20.820 --> 27:26.000]  sometimes these large organizations like the APTs, government agencies, secretariats,
[27:26.000 --> 27:30.640]  whatever you call it, have a little bit of a hard time managing their assets,
[27:30.640 --> 27:38.340]  both the technological and the human ones. Sometimes, object fails happen, like this one.
[27:38.380 --> 27:44.460]  On the sample that I have collected, that I had seized, the file inputfiles.lst, for all those
[27:44.460 --> 27:50.580]  who use Java and Maven, you maybe already know what's going to happen, contains Maven building
[27:50.580 --> 27:54.940]  information. So, based on it, it's possible to ascertain that the author of the malware
[27:54.940 --> 28:01.700]  operates on Windows, and it's called Edward. So, Edward, I know what you did there,
[28:01.700 --> 28:06.180]  you did it right, using Western technology, you traitor of the DPRK.
[28:07.320 --> 28:12.500]  So, let's do a quick wrap-up about this talk, and we will jump to our conclusions,
[28:12.500 --> 28:16.980]  which are more like tips on lessons learned, as you want to call it.
[28:17.600 --> 28:24.340]  So, the idea is how to make a headline out of this. I know this is Spanish, but it's saying,
[28:25.040 --> 28:32.040]  made in North Korea, they found a virus that works like a digital model of... and I know you
[28:32.040 --> 28:38.360]  don't like these headlines, guys, but how do you explain to someone that there is a malware that
[28:38.360 --> 28:44.980]  it's shitty written, sorry, but as Mauro says, it's not well written, it's like something that
[28:44.980 --> 28:49.220]  is not professional, but it's effective, it's not detected by the heuristics,
[28:49.220 --> 28:55.540]  and that kind of thing. So, I write for a newspaper that has this number of print units
[28:57.880 --> 29:02.620]  every day, and these subscriptions, and that's the average age of the readers,
[29:02.620 --> 29:07.840]  so that's something you have to consider. And the big question is, how do we tell the story
[29:09.360 --> 29:16.260]  to my mother, my girlfriend, my sister, my friends, because that's the whole point of it.
[29:16.320 --> 29:22.460]  You hackers are providing incredible, useful insights, and there is, in Argentina, at least,
[29:22.460 --> 29:28.400]  I know, like, for example, here in the States, you have lots of good people that are covering
[29:28.400 --> 29:32.840]  this beat, and it's amazing that that's happened, but in Argentina, we don't have that tradition.
[29:32.840 --> 29:40.260]  We don't have the InfoSec beat covered, right? So, when I try to write this down,
[29:40.260 --> 29:46.760]  I try to think in these three keys, right? First, to translate. You all know, or some of you know,
[29:46.760 --> 29:52.960]  what a RAT is, what an IOC is, what an APT is. I know all of this because I talked to him, right?
[29:52.960 --> 29:57.520]  And after talking to him, I started reading, and I started researching, and gathering information,
[29:57.520 --> 30:05.420]  reading reports from lots of companies that does Intel, not only CrowdStrike, but also Checkpoint,
[30:05.420 --> 30:13.620]  ESET, Palo Alto, all of those companies make very insightful reports that are very useful.
[30:14.180 --> 30:22.100]  And the challenge is to translate all of this, right? When we were talking about the RAT,
[30:22.100 --> 30:26.100]  he was saying, it's like if the attacker is in front of your computer without being there. Well,
[30:26.100 --> 30:33.400]  that's a good explanation, right? So, a malware, it's a virus. I mean, you could kill me because of this,
[30:33.400 --> 30:37.840]  but in order to explain this to a general audience, you have to make some sacrifices.
[30:37.840 --> 30:43.940]  Then in the article, when you're writing, okay, you can use parentheses, commas, and make explanation,
[30:43.940 --> 30:51.540]  there's no problem with that, respecting the journalistic guidelines, right? But this is a
[30:51.540 --> 30:57.280]  work we have to do in the media. We have to assess this kind of work, right? The second key aspect
[30:57.280 --> 31:04.560]  to me is to give voice to specialists, to hackers, to investigators, to researchers. So that's why we
[31:04.560 --> 31:09.960]  got in touch with a hardware expert, a malware analyst, and a threat analysis, and these kind of things.
[31:09.960 --> 31:17.220]  And the other pillar to me is to explain to the audience why this is important. Why does
[31:17.220 --> 31:24.900]  this matter, right? So one thing we were talking not only with Mauro, but other Argentine hackers
[31:24.900 --> 31:36.200]  here, is that this is like the most asked question. When I came here and I started saying in my circles
[31:36.200 --> 31:41.020]  I'm going to DEF CON, oh, what is DEF CON? No, a hacker convention. They told me, what? There's a hacker
[31:41.020 --> 31:48.340]  convention? Is that even legal? Yes, and it's a problem, because I know all of you are very familiar
[31:48.340 --> 31:56.520]  with this problem, but I think the point is to understand that this question on the left
[31:57.380 --> 32:07.320]  is not useful. I mean, why do people keep asking this question? So I think that the journalistic
[32:07.320 --> 32:13.800]  challenge is to shift that question towards how is this intel that you guys are providing
[32:13.800 --> 32:20.780]  changing the information about the world and how we know it? Because the global landscape
[32:20.780 --> 32:26.660]  is changing and it's changing really, really fast, right? So the whole point of publishing these
[32:26.660 --> 32:32.900]  stories that, believe me, I have the freedom to publish like anything in my bit, in my section,
[32:32.900 --> 32:40.240]  in my newspaper, problem is you don't get many users, clicks and that kind of things, right? So that's
[32:40.240 --> 32:44.460]  why you have to make a headline like that with a molotov and that kind of things to catch the eye
[32:44.460 --> 32:50.860]  and then explain like the technical things and try to translate. But for me, the most important thing
[32:50.860 --> 32:57.140]  of the Mauro's investigation was that we could carry out that to a media outlet that is huge and
[32:57.140 --> 33:05.000]  is not used to treat these topics, right? So I would like, I was telling Mauro, thinking that
[33:05.000 --> 33:09.220]  this question is the question that you guys are answering, right? And that deserves a spot in the
[33:09.220 --> 33:16.620]  media and someone that can translate that kind of language, right? And now your grandma fears Kim Jong-un.
[33:17.280 --> 33:24.500]  Cool. So our conclusions or lessons learned from things is that any suspicious activity you find,
[33:24.500 --> 33:29.480]  even the smaller one, regardless of its scale, should be investigated to the last consequences.
[33:29.700 --> 33:34.340]  I got a lot of people telling me to drop it off. It was not worth it. And I only stopped
[33:34.860 --> 33:39.580]  investigating it when I thought myself that it wasn't worth it. But some people even from minute
[33:39.580 --> 33:44.520]  zero say, no, it's not worth it. Allow it to pass. And you don't do it, especially those folks that
[33:44.520 --> 33:51.320]  work in socks. You know that you don't let almost anything pass. You have to be wary of almost
[33:51.320 --> 33:56.840]  anything. Also always share the intel. If I wasn't in the first place sharing the intel, even if I
[33:56.840 --> 34:01.620]  thought that it wasn't worth it, I would have never known that I was playing with a DPRK sample.
[34:02.040 --> 34:06.920]  And always ask the questions. Maybe you can find someone who is asking the same question as you
[34:06.920 --> 34:14.600]  or that has the answer. And media sometimes can be your friend or an asset. And if you want to check
[34:14.600 --> 34:19.840]  the QR log technical analysis and all the IOCs, I'm going to publish the repository in five minutes.
[34:19.840 --> 34:25.580]  I was just finished cleaning it up. I want to be honest, I still can't finish it. It is there.
[34:25.580 --> 34:32.420]  I moved it from my company, Handler, not on Mauro Eldridge. And also if you want to see,
[34:32.420 --> 34:36.800]  again, as he says, Labyrinth Colima tends to hit the headlines.
[34:37.380 --> 34:43.660]  The story was covered on Clarín, Argentina's top newspaper. So you have the link there.
[34:43.660 --> 34:46.880]  We will also share the slides in case you want to copy the link on a more
[34:48.300 --> 34:56.120]  comfortable way. And we need to recognize the help from a lot of people who, without them,
[34:56.120 --> 35:01.560]  this talk wouldn't be possible. Maxi Fehrman for aiding with the sample analysis. Daniel,
[35:01.560 --> 35:08.120]  Merlo, Croucher, AWS, and ESET for their insight. And my folks at the DC5411 and Birmingham Cyberarms.
[35:08.120 --> 35:13.300]  I think I'm not forgetting anyone. Oh, and Edward for providing the sample and giving us one of the
[35:13.300 --> 35:18.140]  most enjoyable jobs we've ever done. Thank you. You have been an amazing panel.