South Korean Universities Targeted By Chinese-Speaking Hackers

PinkStats malware has been used for hacking nation-state targets for four years

A newly discovered attack tool used by multiple groups of Chinese-speaking attackers has infected more than 1,000 machines in South Korea -- mainly universities and other academic institutions.
The so-called PinkStats malware family has been in use over the past four years, targeting various nation-states and organizations around the globe, according to Aviv Raff, CTO at Seculert, which studied the malware and posted its findings today.
This is the first proof that there are Chinese-speaking attackers targeting [South Korea] entities, says Raff, who stopped short at confirming the attackers were from China. Even so, he says its likely that they are Chinese: These type of custom-made tools are usually created by the people speaking the language used in the tool, [such as where] Mahdi used Farsi strings, he says.
Theres no evidence, either, to confirm that PinkStats was also used in the
attacks earlier this year on South Korean banks, media networks, and an ISP
that wiped hard drives and attached drives of infected machines. They also crippled targeted organizations for hours, and the machines werent able to reboot. There was speculation of a North Korea or China connection to the attacks.
[Researchers confirm data-destroying malware that hit South Korean media and banks doesnt completely erase data. See
Data Can Be Recovered From South Korea Data-Wiping Attacks
. ]
PinkStats is a Trojan downloader that can install additional malware components. It camouflages itself by posing as a Web statistics or counter service in its communications to the command-and-control server and in the attackers administrative panel login window.
In the South Korean attack, PinkStats also downloaded a typical Chinese hacking tool called zxarps that acts as a worm to spread in the victims local network, via address resolution protocol (ARP) poisoning. The malicious iFrame it injects includes an ActiveX file digitally signed by Thwate. Seculert says the signature was valid as of May 8 and uses Microsoft Corporation as the product name and Liaocheng YuanEr Technology CO., ltd., as the publisher name -- a phony South Korean company.
PinkStats also installs a DDoS malware tool that goes by Win8.exe and poses as South Korean antivirus company AhnLabs V3 Light Framework software. Up until now, the adversary did not seem to send any specific instructions to the installed DDoS malware. However, with the recent incidents of DDoS attacks against South Korean infrastructure, it is reasonable to assume that this state could change anytime soon, Seculert said in
its blog post
.
Seculerts Raff says the attackers were trying to amass as much computing power as possible from the South Korean universities. They deployed an additional worm tool that spreads the PinkStats malware within the local university network, he says, probably in order to use the machines for DDoS attacks.
Raff says his firm discovered the PinkStats malware while analyzing one of its customers logs. That analysis led to Seculert finding evidence of the South Korean attacks. What makes PinkStats unique is that its a downloader posing as a legitimate Web statistics service. So even if someone will try to investigate the URL of the malware communication and [get] to the login page, he will see a page saying that is a login for statistics administration, he says.
Other attacks using PinkStats have downloaded information-stealing Trojans as well, he says.
It really depends on the group using this tool, and the intent of their current operation and phase, Raff says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
South Korean Universities Targeted By Chinese-Speaking Hackers