Week 8 - Malware Attacks Target Winter Olympics in South Korea

At the start of this year in 2018, about a month before the Winter Olympics begins in South Korea, email infected with malware have been targeting organizations associated with this big event. Initially, the infected emails were targeting groups related to air hockey but have since expanded to all businesses related to the Olympics. The goal of the malware campaign is to steal personal and financial information.

The methodology behind delivering malware through email has greatly improved and is harder than ever to be detected. Companies are aware of the dangers of phishing emails and have enacted security campaigns to counter this threat, but these malware emails are even more difficult to differentiate from regular mail. The spoofed email is in Korean and claims that it is from South Korea's National Counter Terrorism Center (NCTC) even though it originated from an address in Singapore. The emails were also timed to be delivered when the NCTC were conducting their security drills, so businesses were inclined to believe it came from them.

Last year in December, a new method of hiding malware in images were introduced. With this new tool released to the public, Invoke-PSImage allows PowerShell scripts to be hidden in a PNG image. With this ability to hide malware components, the image could be delivered through email.  The recipients would open the image and execute the malware on their computers.

It’s more important than ever to be wary of opening images or text in emails. Even though the file does not seem to be malicious, it can still contain malware. Before opening attachments in emails, it is advised to review the header information and confirm the identity of the sender. If something looks off in the email, report it to the local administrator or delete the email. Phishing emails are becoming difficult to spot, and we must be extra cautious against these malware attacks.

References


AFP. (2018, Jan 6). Hackers Already Targeting Pyeongchang Olympics: Researchers. Retrieved from http://www.securityweek.com/hackers-already-targeting-pyeongchang-olympics-researchers


Riley, D. (2018, Jan 7). Hackers are already targeting the PyeongChang Winter Olympics. Retrieved from https://siliconangle.com/blog/2018/01/07/hackers-already-targeting-yeongchang-winter-olympics/


Samani, R. (2018, Jan 9). Pyeongchang Olympics Hack: Attackers Evolve Beyond Zero Days. Retrieved from https://www.forbes.com/sites/ciocentral/2018/01/09/pyeongchang-olympics-hack-attackers-evolve-beyond-zero-days/#39e00134ef61