ScarCruft’s Evolving Arsenal: Researchers Reveal New Malware Distribution Techniques

Mar 22, 2023Ravie LakshmananCyber Threat Intelligence

The North Korean advanced persistent threat (APT) actor dubbed ScarCruft is using weaponized Microsoft Compiled HTML Help (CHM) files to download additional malware onto targeted machines.

According to multiple reports from AhnLab Security Emergency response Center (ASEC), SEKOIA.IO, and Zscaler, the development is illustrative of the group’s continuous efforts to refine and retool its tactics to sidestep detection.

“The group is constantly evolving its tools, techniques, and procedures while experimenting with new file formats and methods to bypass security vendors,” Zscaler researchers Sudeep Singh and Naveen Selvan said in a new analysis published Tuesday.

ScarCruft, also tracked under the names APT37, Reaper, RedEyes, and Ricochet Chollima, has exhibited an increased operational tempo since the start of the year, targeting various South Korean entities for espionage purposes. It is known to be active since at least 2012.

Last month, ASEC disclosed a campaign that employed HWP files that take advantage of a security flaw in the Hangul word processing software to deploy a backdoor referred to as M2RAT.

But new findings reveal the threat actor is also using other file formats such as CHM, HTA, LNK, XLL, and macro-based Microsoft Office documents in its spear-phishing attacks against South Korean targets.

These infection chains often serve to display a decoy file and deploy an updated version of a PowerShell-based implant known as Chinotto, which is capable of executing commands sent by a server and exfiltrating sensitive data.

Some of the new capabilities of Chinotto include capturing screenshots every five seconds and logging keystrokes. The gathered information is then saved in a ZIP archive and sent to a remote server.

The insights about ScarCruft’s various attack vectors come from a GitHub repository maintained by the adversarial collective to host malicious payloads since October 2020.

“The threat actor was able to maintain a GitHub repository, frequently staging malicious payloads for more than two years without being detected or taken down,” Zscaler researchers said.

Outside of malware distribution, ScarCruft has also been observed serving credential phishing webpages targeting multiple email and cloud services such as Naver, iCloud, Kakao, Mail.ru, and 163.com.

It’s however not clear how these pages are accessed by the victims, raising the possibility that they may have been embedded inside iframes on websites controlled by the attacker or sent as HTML attachments via email.

Also discovered by SEKOIA.IO is a piece of malware named AblyGo, a backdoor written in Go that utilizes the Ably real-time messaging framework to receive commands.

The use of CHM files to smuggle malware appears to be catching on with other North Korea-affiliated groups as well, with ASEC uncovering a phishing campaign orchestrated by Kimsuky to distribute a backdoor responsible for harvesting clipboard data and recording keystrokes.