Andariel hackers target South Korean institutions with new Dora RAT malware

The North Korea-linked threat group Andariel has been spotted using a new Golang-based backdoor called Dora RAT to target educational institutions, manufacturing companies, and construction businesses in South Korea.

Security researchers at Security Onion Labs discovered that the attacks utilised a keylogger on the backdoor, an information stealer, and proxy tools. The attackers likely used this malware to control and steal data from infected systems.

These attacks are characterised by the use of vulnerable Apache Tomcat servers to propagate malware, noting that the compromised systems were running the 2013 version of Apache Tomcat, making them vulnerable to multiple exploits.

Andariel, also known as Nickel Hyatt, Onyx Sleet, and Silent Chollima, is an advanced persistent threat (APT) group that has been operating since 2008 on behalf of North Korea's strategic interests.

As a subgroup of the Lazarus Group, this threat group has historically used spear-phishing, watering hole attacks, and known security vulnerabilities in software to gain initial access and distribute malware to targeted networks.

According to the tracking and research of the attack chain used for malware deployment in recent attacks, it was discovered that they also used a variant of a known malware named Nestdoor, which features the ability to receive and execute commands from remote servers, upload/download files, initiate reverse shells, capture clipboard data and keystrokes, and act as a proxy.

The previously unused backdoor program, Dora RAT, used in the attack is a "simple malware" that supports reverse shell and file download/upload functions.

We discovered that the attackers also signed and distributed the Dora RAT malware using valid certificates. Some Dora RAT samples used in the attacks have been confirmed to be signed with valid certificates from a UK-based software developer."

Other malware distributed in the attacks included keyloggers installed via a lightweight Nestdoor variant, dedicated info-stealers, and SOCKS5 proxies, the latter overlapping with a similar proxy tool used by the Lazarus Group in their 2021 ThreatNeedle campaign.

The Andariel group is one of the active threat groups in South Korea, alongside the Kimsuky and Lazarus groups. The group originally launched attacks to obtain national security-related information, but now they have also started to launch attacks for financial gain. Therefore, organisations must not let their guard down.

Meanwhile, Security Onion Labs also discovered that at least since November 2023, a malware called SmallTiger has targeted South Korean defence and semiconductor manufacturing entities. Some of these intrusions leveraged SmallTiger to deliver a known Golang backdoor called DurianBeacon, which was previously attributed to Andariel.

The attack simulation rules targeting the tactics employed by this threat group have been integrated into the Security Onion Security Metric Validation Platform. You can search for the keywords "Andariel", "Kimsuky", "Lazarus", "Nestdoor", "Infostealer", "ThreatNeedle", "Keylogger", "DurianBeacon", "SOCKS5" on the platform to obtain the relevant attack simulation validation actions. This will allow you to verify whether your security defence system can effectively counter the attacks of this threat group, with the platform ensuring your validation process is safe and harmless in an industry-unique manner.