APT Group 123 Actively Attacking Windows Systems to Deliver Malicious Payloads

North Korean state-sponsored threat actor APT Group 123 has intensified its cyber espionage campaign, specifically targeting Windows systems across multiple sectors globally.

The group, active since at least 2012 and also tracked under aliases such as APT37, Reaper, and ScarCruft, has historically focused on South Korean targets but has expanded operations to Japan, Vietnam, the Middle East, and other regions in recent years.

The sophisticated attacks primarily aim to extract sensitive information from critical sectors including government, aerospace, manufacturing, and high-tech industries.

The threat actor’s primary infection vector involves highly targeted spear phishing emails containing malicious attachments that exploit vulnerabilities in popular word processors, including Microsoft Office applications.

Additionally, the group conducts strategic web compromises through watering hole attacks and drive-by downloads, exploiting vulnerabilities in web browsers and plugins when users visit compromised websites.

These multi-faceted attack vectors demonstrate APT Group 123’s versatility in establishing initial access to target networks.

Cyfirma researchers identified that the impact of these attacks extends beyond information theft, with the group now engaging in ransomware attacks for financial gain alongside their espionage operations.

This dual motivation reflects an evolution in their tactics, as the financial proceeds appear to directly support their broader intelligence-gathering mission.

The group’s persistent operations have affected organizations across at least thirteen countries, with a particular focus on entities possessing valuable intellectual property or strategic information.

Recent intelligence suggests APT Group 123 continues to refine its techniques, incorporating newly disclosed vulnerabilities into their arsenal with remarkable speed.

The group leverages custom malware including ROKRAT, PoohMilk, and Freenki Loader to establish persistent access to compromised systems.

Once inside a network, the attackers move laterally, escalate privileges, and exfiltrate sensitive data to their command and control infrastructure, causing significant operational and security impacts for targeted organizations.

Advanced Defense Evasion Techniques

The sophisticated nature of APT Group 123’s operations is particularly evident in their defense evasion techniques.

The group employs encryption, specifically HTTPS, for command and control communications to blend malicious traffic with legitimate network activity.

This approach makes detection significantly more challenging for traditional security solutions. Their malware typically employs a multi-stage architecture, with payloads split across several components to complicate analysis and detection.

The attackers demonstrate considerable operational security awareness by implementing checks for security and analysis tools within their malware.

When such tools are detected, the malicious code may alter its behavior to avoid triggering alerts.

APT Group 123 frequently employs advanced techniques such as DLL sideloading, where legitimate Windows processes are manipulated to load malicious code, as well as DLL hollowing and call stack spoofing to further evade detection.

Perhaps most concerning is the group’s evolving infrastructure strategy. Cyfirma analysts noted that APT Group 123 increasingly leverages compromised legitimate web servers and cloud-based platforms for their command and control operations.

Previously, they utilized services like X, Yandex, and Mediafire, with recent evidence suggesting potential expansion to mainstream services like Google Drive.

This tactical shift represents a significant challenge for defenders as it further obfuscates malicious network communications behind seemingly legitimate traffic patterns.

How SOC Teams Save Time and Effort with ANY.RUN - Live webinar for SOC teams and managers

The post APT Group 123 Actively Attacking Windows Systems to Deliver Malicious Payloads appeared first on Cyber Security News.