• Home
  • |
  • Blog
  • |
  • What is the new WhiskerSpy Backdoor? Who is behind it?
What is the new WhiskerSpy Backdoor And Who is behind it

Recently a new backdoor was discovered by researchers targeting individuals who show interest in North Korea. The victims were visitors to a pro-North Korea website. The attacker group behind this has been targeting victims since 2019. The threat group is using the watering hole attack method to compromise North Korean related websites, and browser exploits will be injected into them.

We will walk through what is the new WhiskerSpy Backdoor, who is behind these attacks, and what is a watering hole attack in this post.

What is Watering Hole Attack?

The term watering hole attack comes from hunting. Instead of going and finding prey for hunting, the hunter waits for where the prey might come from. It can be most commonly a body of water- the watering hole.

In this case of cyber attack, instead of finding the users or victims, the attacker infects the website where the victims are supposed to visit. These infected websites will eventually compromise the user’s system and might reach the user’s workplace.

If the attacker is not targeting the victim directly, then let’s see how the attackers are executing this attack.

  1. Identifying a website that the victim might visit more frequently
  2. These targeted websites will be of low security and popular with the victims
  3. The targeted site will be compromised, and a malicious code payload will be injected
  4. When this site is visited by the victim, the payload is triggered, and the system will be infected
  5. This exploit payload can be anything. It may be automatic or generate a prompt before downloading
  6. Once the payload is successfully deployed, the attackers can access the information from the compromised system.
How watering hole attacks work?
Credits: Tech Target

What is The New WhiskerSpy Backdoor and Who is Behind This Attack?

By the end of 2022, it was discovered that many of the North Korean sites had been compromised and modified by injecting malicious codes into the website. When the targeted victims visited the website, a prompt appeared showing a video codec error and leading to downloading and installing a tokenized codec installer. This installer was configured to load a new backdoor, ‘the WhiskerSpy Backdoor’. The threat actor was also observed achieving persistence by abusing chromes native messaging host.

 WhiskerSpy Backdoor
The WhiskerSpy infection chain. Source: Trend Micro

The attacker group behind these attacks is identified to be an advanced persistent threat actor known as Earth Kitsune. This group has been active since 2019, doing multiple malicious activities, developing and distributing backdoors, especially targeting the people interested in North Korea.

Technical Analysis

By the end of 2022, Trend Micro researchers observed that a malicious code was injected into the video pages of a pro-North Korean website. The site showed an error message redirecting the victims to install a malicious payload that is camouflaged as an Advanced Video Codec – AVC1.

Technical Analysis of WhiskerSpy Backdoor
Source: Trend Micro

This attack was targeted only to some users, i.e., if the visitor is not from the targeted IP addressed, the pop-up with malicious payload won’t appear. This made it more difficult to identify the attack. The targeted victim Ip’s are mainly from China, Japan, and Brazil.

See Also  A Short Intro About Prompt Engineering

The patched installer file is an MSI file that contains another NSIS installer. The attacker abused a legitimate installer (windows.10.codec.pack.v2.1.8.setup.exe) and patched malicious shell code into it. This shell code can additionally download different stages of malware by running several PowerShell commands.

The attacker tried to maintain persistence through multiple methods like using one drive side loading vulnerabilities, using malicious google chrome extensions, etc. The main backdoor loader was named as WhiskerSpy.

WhiskerSpy- The Main Payload

WhiskerSpy exchanges the encryption key between the server and client using elliptic-curve cryptography (ECC). Some of the implemented backdoor commands are:

  • interactive shell
  • downloading file
  • uploading file
  • deleting the file
  • listing the files
  • taking screenshots
  • load the executable and call its export
  • inject shellcode into the processThis back door generates a random 16-byte AES key for communicating with the command-and-control server.

MITRE ATT&CK Identifiers

  • T1005 (Data from Local System)
  • T1027 (Obfuscated Files or Information)
  • T1036 (Masquerading)
  • T1037.005 (Startup Items)
  • T1055 (Process Injection)
  • T1059.001 (PowerShell)
  • T1083 (File and Directory Discovery)
  • T1105 (Ingress Tool Transfer)
  • T1106 (Native API)
  • T1113 (Screen Capture)
  • T1176 (Browser Extensions)
  • T1185 (Browser Session Hijacking)
  • T1189 (Drive-by Compromise)
  • T1190 (Exploit Public-Facing Application)
  • T1204.002 (Malicious File)
  • T1485 (Data Destruction)
  • T1573 (Encrypted Channel)

IOC

Please find the IOCs here

SHA 256

CE7016067C97421E3050FA8BD7F1950E0707E6DEEAC20003F5F30F1C58F435BCTrojan.JS.SLUB.A
1C24D9013B3EAE373FC28D40F9E475E1DD22C228E8F1E539ED9229E21807839DTrojan.Win32.SLUB.AA
076BA1135B2F9F4DBC38E306DC533AF71B311C1DC98788C18253448FCA096C46Trojan.Win32.SLUB.AA
371CFA10A7262438E5BC0694BA5628EB21E044DC8173710DF51826DAFA11E300Trojan.Win32.SLUB.B
E01399D47CDA45F1AF496FA460F20620A5B08C39714875FE292A5FC3D1C7A215Trojan.Win32.SLUB.B
6F0A0AC477C73C2533A39CB3D8FBF45365761D11B7368460964A4572E91C5FCBTrojan.Win64.SLUB.B
C357E572DD7C618C54F8333313266A8A9CF07C1038D6B2F711CDBAE714BC2654Trojan.JS.SLUB.A
902902B5457C6945C2B3878521D23D05D448DE179D19761C718FB67C15A4BCC0Trojan.Win64.SLUB.B
20C214D58CCFB5AD797F1A02667078D182629AC7E157162566C123519E039D55Trojan.Win32.SLUB.B
3D62E122E31D7929E76633773D752B8BEE31462BB79CB5B8B7C6952341E93482Trojan.Win32.SLUB.B
66C8E0ACFE030C4EEC474CD75C4D831601DAE3EF4E1CEF78B624DE3C346C186DTrojan.Win32.SLUB.B
C78CB41F4FB4E5F5476EB2C1414F138643494C2B8ABE2CF539FAFC54199E2AEFTrojan.Win32.SLUB.B
FBAC7B40A12970CDCC36F48945BEB83BF9461F14C59CB8106AD8E43E5D22A970Trojan.Win32.SLUB.B
7365F661AD9E558FDD668D3563E0A1B85CCF1A543BE51CB942DB508F9CCBCF5ETrojan.Win32.SLUB.B
3D4107C738B46F75C5B1B88EF06F82A5779DDD830527C9BECC951080A5491F13Backdoor.Win64.WHISKERSPY.A
84E9BCC055225BD50534147E355834325B97AD948C3A10D792928B48C56C1712Backdoor.Win64.WHISKERSPY.A
EFFA1AE32DBCF6BC64A5025BCA4F4C41572439B69EDD58B5F78952A407CEB5DFBackdoor.Win32.WHISKERSPY.A

Domain

microsoftwindow[.]sytes[.]net
updategoogle[.]servehttp[.]com
londoncity[.]hopto[.]org
windowsupdate[.]sytes[.]net
florida[.]serveblog[.]net
googlemap[.]hopto[.]org
liveupdate[.]servepics[.]com
chromecast[.]hopto[.]org
googlemap[.]serveblog[.]net
selectorioi[.]ddns[.]net
rs[.]myftp[.]biz

Conclusion

This is a very interesting attack the technologies used in this attack are IP address, Cryptography, JavaScript, etc., and the attack vectors include Shell Code, Social Engineering, and Watering hole attack. These kinds of attacks can be prevented by creating proper defense-in-depth technologies and educating users not to fall for such attacks.

I hope this article helped you learn more about the new WhiskerSpy Backdoor, who is behind these attacks, and what is a watering hole attack. Please share this post and help to secure the digital world. Visit our social media page on FacebookLinkedInTwitterTelegramTumblrMedium & Instagram, and subscribe to receive updates like this. 

Read More:

About the author

Aroma Rose Reji

Aroma is a cybersecurity professional with more than four years of experience in the industry. She has a strong background in detecting and defending cyber-attacks and possesses multiple global certifications like eCTHPv2, CEH, and CTIA. She is a pet lover and, in her free time, enjoys spending time with her cat, cooking, and traveling. You can connect with her on LinkedIn.

Leave a Reply

Your email address will not be published. Required fields are marked

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}

Learn Something New with Free Email subscription

Email is also one of the ways to be in touch with us. Our free subscription plan offers you to receive post updates straight to your inbox.