North Korean hackers target phones, Windows devices with new malware

Magnifying glass enlarging the word 'malware' in computer machine code
(Image credit: Shutterstock)

State-sponsored North Korean hackers are once again targeting victims with a new form of malware that could possibly hijack mobile and PC devices.

According to a new report from cybersecurity researchers AhnLab, a group known as APT37 (AKA RedEyes, Erebus, a known North Korean group believed to be strongly affiliated with the government), was seen distributing malware dubbed “M2RAT” to spy on, and extract sensitive data from, target endpoints.

The campaign, which kicked off in January 2023, started with a phishing email that distributes a malicious attachment. The attachment exploits an old EPS vulnerability, tracked as CVE-2017-8291, found in Hangul, a word processor program usually used in South Korea.

Using steganography

This interaction triggers the download of a malicious executive, stored in a JPEG image. 

Using steganography (a method of hiding malware in pictures and other non-malicious file types), the attackers are able to exfiltrate the M2RAT and inject it into the explorer.exe file.

The M2RAT itself, researchers say, is relatively basic. It logs key entries, steals files, can run various commands, and take screenshots automatically. However, it has a unique feature that caught their attention - the ability to scan for portable devices, such as smartphones, connected to the compromised Windows endpoint. If it detects such a device, it will scan it, and download any files and voice recordings to the Windows machine. After that, it will compress it into a password-protected .RAR archive and send to the attackers. 

Finally, it will delete the local copy to remove any evidence of any wrongdoing. 

The malware was also observed using a shared memory section for command & control (C2) communication, as well as data theft. That way, it doesn’t have to store the stolen files in the compromised system and leave any traces. 

APT37 is quite an active threat actor. It was last seen in December last year, when researchers saw it abuse a flaw in Internet Explorer to target individuals in South Korea.

Via: BleepingComputer

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
North Korean flag with a hooded hacker
North Korean hackers are posing as software development recruiters to target freelancers
A digital representation of a lock
Looking for a new job? Watch out you don't fall for this new malware scam
Image depicting a hand on a scanner
New Lazarus Group campaign sees North Korean hackers spreading undetectable malware through GitHub and open source packages
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
Malware worm
Coordinated global mobile malware campaign targets banking apps and cryptocurrency platforms
Image of laptop infected with malware threat
This devious new macOS malware disguises itself as Chrome, Zoom installers
Latest in Security
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Code Skull
Interpol operation arrests 300 suspects linked to African cybercrime rings
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Multiple routers hit by new critical severity remote command injection vulnerability, with no fix in sight
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
An abstract image of a lock against a digital background, denoting cybersecurity.
Critical security flaw in Next.js could spell big trouble for JavaScript users
Latest in News
DeepSeek
Deepseek’s new AI is smarter, faster, cheaper, and a real rival to OpenAI's models
Open AI
OpenAI unveiled image generation for 4o – here's everything you need to know about the ChatGPT upgrade
Apple WWDC 2025 announced
Apple just announced WWDC 2025 starts on June 9, and we'll all be watching the opening event
Hornet swings their weapon in mid air
Hollow Knight: Silksong gets new Steam metadata changes, convincing everyone and their mother that the game is finally releasing this year
OpenAI logo
OpenAI just launched a free ChatGPT bible that will help you master the AI chatbot and Sora
An aerial view of an Instavolt Superhub for charging electric vehicles
Forget gas stations – EV charging Superhubs are using solar power to solve the most annoying thing about electric motoring