Emailed Cyberattack Targets 2018 Pyeongchang Olympics

More than 300 organizations associated with the 2018 Olympics have been hit with a targeted email campaign.

A fileless malware campaign was discovered targeting organizations associated with the upcoming 2018 winter Olympics being held in Pyeongchang, South Korea, report analysts at McAfee Advanced Threat Research. An unknown nation-state attacker is likely responsible.
The campaigns primary target was [email protected] with 337 South Korean organizations included on the BCC line. Most targets had some involvement in the Olympics, either in providing infrastructure or playing another supporting role.
This attack arrived as a spearphishing email containing a malicious Word attachment with the original file name Organized by Ministry of Agriculture and Forestry and Pyeongchang Winter Olympics (translated from Korean). Emails began on Dec. 22, 2017 with the most recent activity appearing on Dec. 28, when messages were sent from an IP address in Singapore.
Emails were disguised to appear to be from South Koreas National Counter-Terrorism Center (NCTC). At the time, the NCTC was conducting physical anti-terror drills to prep for the Olympics, which suggests the email is legitimate and increases the odds people will open it.
The malicious document, which contains an obfuscated Visual Basic macro, prompts recipients to open it in their version of Microsoft Word and launches a PowerShell script when Enable Content is clicked. Attackers used an open-source steganography tool Invoke-PSImage, released on Dec. 20, to hide malicious PowerShell code on a remote server.
This process ultimately delivers an implant, which creates an encrypted channel to the attackers server and gives them the ability to execute commands on the victims machine. The goal was to evade detection technologies that rely on pattern matching, researchers
explain
.
Based on the use of fileless malware to weaponize steganography tools and quickly deploy it in an active attack … this is the work of a nation state, says McAfee senior analyst Ryan Sherstobitoff. At this time, there is no information to support which country is responsible.
Threat actors are casting a wide net, researchers report, and their choice of victim is significant.
This is one notable incident where you have an attacker with the hallmarks of a nation state who took deliberate interest in conducting reconnaissance and identifying a number of targets involved with planning the winter Olympics, says Sherstobitoff.
General cybercriminals may use the upcoming Olympics as a lure to target consumers and make money, Sherstobitoff explains. This actor, with the intention of sneaking onto victims machines, is more interested in understanding the events unfolding in the region.
The attacker is getting an inside look at whats happening behind the scenes, Sherstobitoff says. While analysts havent yet seen the full effect, he says this could be potentially damaging. With the data collected, a threat actor could hold information for ransom, making it difficult to engage with them further, or cause embarrassment for the host country.
Its increasingly common to see in-memory implants using PowerShell and obfuscation to avoid detection, though researchers note this type of attack has not been previously seen targeting users in South Korea. Use of the steganography tool, which was used in this campaign less than a week after its release, implies the actors are savvy to new tools.
McAfee reports fileless threats continued to grow in Q3 and PowerShell malware grew by 119%. The techniques [here] have significantly grown from being used infrequently to being used quite often, says Sherstobitoff. This technique is interesting, especially when involved in high-profile, targeted attacks.
Many cyberattacks continue to exploit basic security vulnerabilities and user behavior; however, the rise in fileless threats shows more are abusing system vulnerabilities, says McAfee Labs vice president Vincent Weafer.
By leveraging trusted applications or gaining access to native system operating tools such as PowerShell or JavaScript, attackers have made the development leap forward to take control of computers without downloading any executable files, at least in the initial stages of the attack, he says.
Related Content:
US Gov Outlines Steps to Fight Botnets, Automated Threats
The Nightmare Before Christmas: Security Flaws Inside our Computers
Vendors Rush to Issue Security Updates for Meltdown, Spectre Flaws
Google Apps Script Vulnerability Exposes SaaS to URL-based Threats

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Emailed Cyberattack Targets 2018 Pyeongchang Olympics