BBC: Hackers have attempted to steal sensitive data from groups involved with next month’s Winter Olympics, cyber-security firm McAfee said.
The report found malware-infected emails were sent last month to organisations linked to the Pyeongchang Games.
It did not identify those responsible, but said more attacks tied to the upcoming Olympics were likely.
In similar past attacks, hackers tried to obtain passwords and financial data.
‘Casting net wide’
McAfee said a number of groups associated with the Olympics had received malicious emails – including several affiliated with ice hockey.
“The majority of these organisations had some association with the Olympics, either in providing infrastructure or in a supporting role,” the security firm said.
“The attackers appear to be casting a wide net with this campaign.”
- Cyber-attack: US and UK blame North Korea for WannaCry
- North Korea ‘hacked crypto-currency exchange in South’
- Will North Korea compete in Winter Olympics?
The emails were sent from a Singapore IP address and told readers to open a text document in Korean.
McAfee said the hackers were trying to trick recipients into believing the emails had come from South Korea’s National Counter-Terrorism Center – which at the time was in the process of conducting anti-terror drills in the region.
In some cases the hackers used a technique in known as steganography which hides malware in text and images.
McAfee echoed recent warnings from University of California researchers to expect more cyber-attacks targeting major sporting events.
“With the upcoming Olympics, we expect to see an increase in cyber attacks using Olympics-related themes,” the security firm said.
It comes as Pyongyang prepares to hold official talks with South Korea for the first time in more than two years.
North Korea accepted an offer to attend the meeting on 9 January that will focus on finding a way for its athletes to attend the Games.
***
It uses a previously unseen form of malware designed to hand control of the victim’s machine over to the attackers. Among those sent the messages are individuals associated with the ice hockey tournament at the Games. The attack has been dubbed ‘Operation PowerShell Olympics’ by the researchers at McAfee Labs, who uncovered it taking place in late December.
The lure document used in the cyber-attacks targeting the South Korea Winter Olympics.
Image: McAfee Labs
During the course of the investigation, researchers discovered a cached Apache server log which showed an IP address from South Korea connecting to the specific URL paths contained in the PowerShell implants, indicating that the intended targets were likely to have been infected.
Further investigation revealed the IP address from the PowerShell implant was connected to an anonymous domain provider based in Costa Rica, with the attacker using this domain to link up to the South Korean Ministry of Agriculture and Forestry, which the attacker has somehow managed to use parts of to carry out the attack.
Researchers are uncertain how many have been infected by the attack, but the campaign is thought to have targeted a wide range of South Korean organisations in the run up to the Winter Olympics. In similar campaigns in the past, victims were targeted for their passwords and financial information.
The phishing document was created on December 22, but rather than containing macros, it uses OLE (Objective Linking and Embedding) streams to carry out the attack. The document has been created by the same author, ‘John’, who created the malicious PowerShell script.
However, despite some evidence about how the attacks took place, researchers haven’t been able to identify the perpetrator — but they do note that whoever is behind the campaign must be fluent in the Korean language and the motive is to gather intelligence about organisations involved in the South Korea-hosted Winter Olympics.
“Technical details alone are often not enough to determine attribution. We are able to ascertain that the attackers have been trained in Korean language to ensure that the targets open the attachment, and the objective seems to be to gather information on the planning, direction and infrastructure related to the Olympics,” said Sherstobitoff.
Researchers warn that in the run up to the Winter Olympics, attackers will continue to use the event as a lure to carry out cyber-attacks.
To avoid falling victim to such attacks — including fileless malware distributed as part of Operation Powershell Olympics — organisations should educate their employees to be mindful of suspicious emails and unexpected attachments. More here from zdnet
