A noisy malware campaign against South Korea is revealing deeper secrets.
A new report
from security vendor McAfee into the March 20 “Dark Seoul” attacks,
which wiped data from bank computers, shut down ATMs and crippled
government websites, describes a much less conspicuous parallel
operation designed to steal classified military data.
McAfee’s report asserts that “the attacks on South Korean targets were actually the conclusion of a covert espionage campaign.”
groups, the Whois Hacking Team and the NewRomanic Cyber Army Team, were
thought to be behind the March 20 attacks. But McAfee now suspects both
teams are part of the same group due to similarities in the attack code
An analysis of malware used by the group suggests it has
been running a spying operation against South Korean targets since 2009,
according to McAfee’s report. The prominent attacks against websites
and banks earlier this year may have been intended as a distraction.
named the military component of the group’s activity “Operation Troy”
due to the use of the word “Troy” in compiled versions of malware.
hackers sought to compromise military computers by luring victims to a
military-focused social networking website where their computers would
be attacked or by sending potential targets spear-phishing emails.
the malware successfully infected a computer, the program scans the
hard drive, hunting around for interesting files. Since large-scale data
theft can often raise alarms, this malware was more picky.
malware does not extract every document that is found as a match through
drive scanning; rather it assigns a unique signature to the infected
system according to what it contains,” McAfee wrote. “Less interesting
systems are less likely to have documents extracted from them.”
malware looks for military unit names, programs and other military
keywords. It searched for those keywords, which includes “operation,”
“secret” and “OPLAN,” in English and Korean. If an interesting file is
downloaded, the attackers’ program sends it over an encrypted http
The malware used in the military attacks could also be used to wreck the systems, the report said.
espionage malware has the capability to destroy systems in the same way
that the March 20, 2013, attacks disabled thousands of systems in South
Korea,” McAfee wrote. “This capability could be devastating if military
networks were to be suddenly wiped after an adversary had gathered