Monday, May 12, 2025
HomeMalwareNorth Korean Hacker Group Uses Browser Exploits to Deliver a Custom Malware

North Korean Hacker Group Uses Browser Exploits to Deliver a Custom Malware

Published on

SIEM as a Service

Follow Us on Google News

The security experts of the cybersecurity firm, Volexity have recently reported an attack through which the North Korean Hacker Group using browser exploits to deploy the customer malware on the website.

It’s a very well-known North Korean hacker group that was behind this attack, not only this but they also have a limited number of victims utilizing exploits for vulnerabilities in a web browser to deliver custom malware.

The threat group behind this attack was called InkySquid, and they are using this exploit since 2020 in attacks against the Internet Explorer browser to download obfuscated Javascript code that is generally hidden inside the legitimate code.

- Advertisement - Google News

SWC Activity

According to the security researchers, in April 2021 Volexity has recognized suspicious code that was loaded through www.dailynk[.]com to ill-disposed subdomains of jquery[.]services. 

There are two types of URLs that have been found, and that’s why we have mentioned them below:-

  • hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
  • hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

The threat actors’ attacks have involved code that was only attached for a very short period of time, and soon after the operation, it was quickly removed. 

According to the report of the analysts, making a description of this activity is quite difficult as the ill-disposed content was hard to identify.

Security flaws

  • CVE-2020-1380 (CVSS score: 7.5) – Scripting Engine Memory Corruption Vulnerability

Initially, Volexity was able to recognize the malicious code, and the threat actor was seen using the CVE-2020-1380, an exploit for Internet Explorer.

  • CVE-2021-26411 (CVSS score: 8.8) – Internet Explorer Memory Corruption Vulnerability

This CVE was used, in another exploit that is targeting the Internet Explorer as well as the legacy versions of Microsoft Edge. However, the redirect code was fixed up in a similar way as it was placed in the CVE-2020-1380.

Subdirectory names used

Below we have mentioned the subdirectory names used by the hackers:-

  • logo
  • normal
  • background
  • theme
  • round

Data gathered

Here’s the list of data that were gathered by the threat actors:-

  • Username
  • Computer name
  • OS version
  • Web IP
  • Local IP of default interface
  • LocalTime
  • Whether the implant binary is 32 or 64 bit
  • Process SID authority level
  • Process filename
  • List of AV products installed
  • Whether the infected machine has VM tools running

BLUELIGHT

The threat actors have implemented many attacks, and that’s why they have used a different subdomain of jquery[.]services so that they can host a new and novel malware family.

The security researchers pronounced that the “history” file was an XOR-encoded (0xCF) copy of a custom malware family and both the malware developer as well as the Volexity assign to as BLUELIGHT. 

The BLUELIGHT is generally used as a secondary payload that normally follows the successful performance of the Cobalt Strike. However, these strikes were generally used as an initial payload in both cases of exploitation.

In BLUELIGHT’s operations, the threat actors generally used the Microsoft Graph API for Microsoft 365, Office, and other services. As per the report of Volexity, a North Korean threat group, named as ScarCruft or APT37, is also behind the InkySquid attacks. 

Moreover, the experts are trying their best to know all the key details of this attack, and how it has been initiated so that they will easily bypass this kind of attack in the future.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core...

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded...

20-Year-Old Proxy Botnet Network Dismantled After Exploiting 1,000 Unpatched Devices Each Week

A 20-year-old criminal proxy network has been disrupted through a joint operation involving Lumen’s...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

“PupkinStealer” – .NET Malware Steals Browser Data and Exfiltrates via Telegram

A new information-stealing malware dubbed “PupkinStealer” has emerged as a significant threat to individuals...

New Stealthy .NET Malware Hiding Malicious Payloads Within Bitmap Resources

Cybersecurity researchers at Palo Alto Networks' Unit 42 have uncovered a novel obfuscation method...