Trademarks of South Korea's cyber attacker- DarkSeoul

After South Korea got cyber attacked on the Korean War anniversary last week, it was found that the distributed denial-of-service (DDoS) attacks observed against the South Korean government websites have a direct link to the DarkSeoul gang and Trojan.Castov, a statement from Symantec Security states.

Dark Seoul's attacks include the devastating Jokra attacks in March 2013 that wiped numerous computer hard drives at South Korean banks and television broadcasters, and the attacks on South Korean financial companies in May 2013. Conducting DDoS attacks and hard disk wiping on key historical dates is not new for the DarkSeoul gang. They previously conducted DDoS and wiping attacks on the United States Independence Day as well.

Symantec has observed that the DarkSeoul gang's attacks tend to follow similar methods of operation. Trademarks of their attacks include:
· Multi-staged, coordinated attacks against high-profile targets in South Korea
· Destructive payloads, such as hard disk wiping and DDoS attacks configured to trigger on historically significant dates
· Overwriting disk sectors with politically-themed strings
· Use of legitimate third-party patching mechanisms in order to spread across corporate networks
· Specific encryption and obfuscation methods
· Use of specific third-party webmailer servers to store files
· Use of similar command-and-control structures

The attacks conducted by the DarkSeoul gang have required intelligence and coordination, and in some cases have demonstrated technical sophistication. While nation-state attribution is difficult, South Korean media reports have pointed to an investigation which concluded the attackers were working on behalf of North Korea. Symantec expects the DarkSeoul attacks to continue and, regardless of whether the gang is working on behalf of North Korea or not, the attacks are both politically motivated and have the necessary financial support to continue acts of cyber sabotage on organizations in South Korea. Cyber sabotage attacks on a national scale have been rare-Stuxnet and Shamoon (W32.Disttrack) are the other two main examples. However, the DarkSeoul gang is almost unique in its ability to carry out such high-profile and damaging attacks over several years.

The Castov DDoS attack occurs in the following manner:
1. Compromised website leads to the download of SimDisk.exe (Trojan.Castov), a Trojanized version of a legitimate application.
2. SimDisk.exe drops two files onto the compromised system: SimDisk.exe (Clean), the legitimate non-Trojanized version, and SimDiskup.exe (Downloader.Castov).
3. Downloader.Castov connects to a second compromised server to download the C.jpg file (Downloader.Castov), an executable file which appears to be an image.
4. Threat uses the Tor Network to download Sermgr.exe (Trojan.Castov).
5. Castov drops the Ole .dll file (Trojan.Castov) in the Windows system folder.
6. Castov downloads the CT.jpg file from a Web server hosting a ICEWARP webmail, that has been compromised as a result of publicly known vulnerabilities in ICEWARP. The CT.jpg file contains a timestamp used by Castov to synchronize attacks.
7. Once this time is reached, Castov drops Wuauieop.exe (Trojan.Castdos).
8. Castdos begins to overload the Gcc.go.kr DNS server with DNS requests, effectively performing a DDoS attack affecting multiple websites.

On the Korean War anniversary, the South Korean government and media agencies were attacked around 9.30 am with the defacement of the Presidential Office - Cheong WaDae's website, and extending to the office of Government Policy Coordination. The defaced website showed message that read "Great leader Kim Jong-un" - North Korea's top Leader.

Website defacement is only the tip of the iceberg; personal identifiable information of the members of the military and government, including the Presidential Office, and the ruling Saenuri party has been compromised, reckons Trend Micro.