North Korean Defectors Targeted with Malicious Apps on Google Play

Sun Team hacking group is behind RedDawn, which steals victims’ photos and data and passes them to threat actors.

A new form of mobile malware in the Google Play app store was found targeting North Korean defectors and journalists.

McAfee researchers believe the Sun Team hacking group is responsible for the attacks, which McAfee has dubbed RedDawn. This is the second attack McAfee has seen from Sun Team this year. Back in January, McAfee’s Mobile Research Team covered another form of Android malware targeting North Korean defectors and journalists, uploaded on Google Play as “unreleased” app versions. Researchers pinged the Korea Internet & Security Agency and Google, which took the malware off its app store.

More than 30,000 people defected from North Korea to South Korea in 2016, Radio Free Asia reports, and McAfee found Sun Team is still trying to plant spyware onto their devices. Because the malware was detected and removed by Google at an early stage, the number of infections on Google Play is still at less than 100. There have been no publicly reported incidents.

Researchers found three apps on Google Play uploaded by Sun Team, an attribution they made based on email accounts and Android devices from the January campaign. The attackers used cloud services to store information logs from the same test Android devices used in the January campaign, and these logs shared formatting and abbreviations with other Sun Team logs. The email address for the new malware author is also identical to other emails linked to the group.

One of the apps used in this campaign is called Food Ingredients Info; the other two are security-related. Fast AppLock steals device data and receives commands and executables from a cloud control server. AppLockFree is part of the reconnaissance stage and sets a foundation for the rest of the attack. All apps are multi-staged with several components, McAfee believes.

The apps spread to victims’ friends, who are prompted to install them by a fake Facebook user and offer feedback. Once on a device, the malware uses Dropbox and Yandex to upload data and send commands, another characteristic previously seen in earlier Sun Team attacks.

Intel on the test devices and attempted exploits uncovered more. The phones used were manufactured in different countries and held Korean apps. Exploit codes discovered in the group’s cloud storage include sandbox escape, code execution, and privilege escalation exploits, with modifications showing the actors aren’t advanced enough to find zero-days and write their own. But it’s likely just a matter of time until they are able to do so, according to the researchers.

What experts find most concerning about this attack is the group used photos found on social media, and identities of South Koreans, to create the fake accounts that spread malware. Evidence shows people have had their identities stolen and they expect more could follow.

Who is Sun Team?

Researchers analyzed the hacking group’s operations and found different versions of their malware, which started to become active in 2017 and stayed online for about two months after being removed from Google Play, they report in a blog post on their newest finding. All of their malware is spyware, built with the intention of lifting data from victims’ devices.

It seems the Sun Team actors may be poorly trying to disguise themselves as South Korean. A few Korean words lifted from the malware’s control server are not in South Korean vocabulary, and Dropbox account names in both campaigns were from South Korean drama or celebrities. The app descriptions in the new campaign also includes awkward Korean writing.

“These features are strong evidence that the actors behind these campaigns are not native South Koreans but are familiar with the culture and language,” researchers say. While they haven’t confirmed the actors’ nationalities, an exposed IP address points to North Korea.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial … View Full Bio

More Insights

Read More HERE