Threat Signal Report
Multi Agency Advisory on "AppleJeus" - HIDDENCOBRA/LAZARUS Activity Targeting Individuals and Organizations Involved in Cryptocurrency Trading
Today, The United States Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) published a joint advisory alert on a North Korean threat campaign dubbed AppleJeus. This latest threat activity highlights the usage of social engineering attacks to lure and prey on individuals and organizations highly leveraged in the cryptocurrency space. Unsuspecting victims are tricked into installing malicious programs that masquerade as legitimate cryptocurrency programs (exchanges and wallets). Tactics used by the HIDDEN COBRA/LAZARUS/APT 38/BeagleBoyz threat actors in this latest campaign are phishing, spearphishing, social networking and social engineering attacks.
What are the Technical Details of the Report?
The report provides technical descriptions of (28) different files used in this attack. According to details within the report, there are 7 different iterations of the AppleJeus malware and they are:
AppleJeus Version 1: Celas Trade Pro (drops FALLCHILL RAT)
AppleJeus Version 2: JMT Trader (payload unknown)
AppleJeus Version 3: Union Crypto Trader (Windows drops DLL file, OSX payload unknown)
AppleJeus Version 4: Kupay Wallet (Windows payload unknown, OSX payload read/write, send/receive payload, command execution)
AppleJeus Version 5: CoinGoTrade (payload unknown)
AppleJeus Version 6: Dorusio (payload unknown)
AppleJeus Version 7: Ants2Whale (payload unknown)
These AppleJeus variants were sophisticated multi-platform attacks targeting Windows and MacOS machines with various open source projects repurposed within. Once loaded, they appear to be legitimate cryptocurrency trading platforms or wallets which were convincing enough in look and feel to social engineer the user to continue the installation process which ultimately allowed the HIDDENCOBRA threat actors to exfiltrate sensitive data from targeted machines to predetermined C2 server(s). Observed verticals attacked were in the energy, finance, government, industrial, technology, and telecommunications sectors in a global campaign.
Why is HIDDEN COBRA/LAZARUS/APT38/BeagleBoyz Significant?
HIDDEN COBRA has been linked to multiple high-profile, financially-motivated attacks in various parts of the world - some of which have caused massive infrastructure disruptions. Notable attacks include the 2014 attack on a major entertainment company and a 2016 Bangladeshi financial institution heist that almost netted nearly $1 Billion (USD) for the attackers. Had it not been for a misspelling in an instruction that caused a bank to flag and block thirty transactions, HIDDEN COBRA would have pulled off a heist unlike any other. Although HIDDEN COBRA failed in their attempt, they were still able to net around 81 million dollars in total.
The most recent notable attack attributed to HIDDEN COBRA was the Wannacry Ransomware attack, which resulted in massive disruption and damage worldwide to numerous organizations, especially those in manufacturing. Various estimates of the impact were in the hundreds of millions of dollars, with some estimates claiming billions. Other verticals which this group has targeted include critical infrastructures, entertainment, finance, healthcare, and telecommunication sectors across multiple countries.
Who are the BeagleBoyz?
The BeagleBoyz group is a newly identified group that is a subset of activity by the threat actors known as HIDDEN COBRA/LAZARUS/APT 38 and has been observed committing financial crimes, specifically cryptocurrency related thefts. Further information about the BeagleBoyz can be found here.
What is the Severity of Impact?
The severity should be regarded as MEDIUM, due to the fact that these campaigns have been observed in limited to targeted attacks.
It Appears that Some Malware Variants Have Been Reported Before. Is this Correct?
Yes. Some of the malware variants in this report, such as the AppleJeus campaigns were first reported by vendors in 2018. FALLCHILL was first reported in 2017.
What is the Status of Protections for this Event?
FortiGuard Labs has AV coverage in place for publicly available samples as:
For FortiEDR protections, all publicly available IOC's were added to our Cloud intelligence and will be blocked if executed on customer systems.
All network IOC's are blocked by the WebFiltering client.
Any Other Suggested Mitigation?
Due to the ease of disruption and due to the disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.
It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine the risk to the organization.
Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.
Traffic Light Protocol
|Color||When Should it Be used?||How may it be shared?|
TLP: REDNot for disclosure, restricted to participants only.
|Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused.||Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.|
TLP: AMBERLimited disclosure, restricted to participants’ organizations.
|Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.||Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.|
TLP: GREENLimited disclosure, restricted to the community.
|Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector.||Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.|
TLP: WHITEDisclosure is not limited.
|Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.||Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.|