North Korea Hackers Using New “Dolphin” Backdoor to Spy on South Korean Targets

The North Korea-linked ScarCruft group has been
attributed to a previously undocumented backdoor called
Dolphin that the threat actor has used against targets
located in its southern counterpart.

“The backdoor […] has a wide range of spying capabilities,
including monitoring drives and portable devices and exfiltrating
files of interest, keylogging and taking screenshots, and stealing
credentials from browsers,” ESET researcher Filip Jurčacko said^[1]
in a new report published today.

Dolphin is said to be selectively deployed, with the malware
using cloud services like Google Drive for data exfiltration as
well as command-and-control.

The Slovak cybersecurity company said it found the implant
deployed as a final-stage payload as part of a watering hole attack
in early 2021 directed against a South Korean digital
newspaper.

The campaign, first uncovered by Kaspersky^[2]
and Volexity^[3]
last year, entailed^[4]
the weaponization of two Internet Explorer flaws (CVE-2020-1380^[5]
and CVE-2021-26411^[6]) to drop a backdoor
named BLUELIGHT.

ScarCruft, also called APT37, InkySquid, Reaper, and Ricochet
Chollima, is a geo-political motivated APT group that has a track
record of attacking government entities, diplomats, and news
organizations associated with North Korean affairs. It’s been known
to be active since at least 2012.

Earlier this April, cybersecurity firm Stairwell disclosed^[7]
details of a spear-phishing attack targeting journalists covering
the country with the ultimate goal of deploying a malware dubbed
GOLDBACKDOOR that shares overlaps with another ScarCruft backdoor
named BLUELIGHT.

The latest findings from ESET shed light on a second, more
sophisticated backdoor delivered to a small pool of victims via
BLUELIGHT, indicative of a highly-targeted espionage operation.

This, in turn, is achieved by executing an installer shellcode
that activates a loader comprising a Python and shellcode
component, the latter of which runs another shellcode loader to
drop the backdoor.

“While the BLUELIGHT backdoor performs basic reconnaissance and
evaluation of the compromised machine after exploitation, Dolphin
is more sophisticated and manually deployed only against selected
victims,” Jurčacko explained.

What makes Dolphin a lot more potent than BLUELIGHT is its
ability to search removable devices and exfiltrate files of
interest, such as media, documents, emails, and certificates.

The backdoor, since its original discovery in April 2021, is
said to have undergone three successive iterations that come with
its own set of feature improvements and grant it more detection
evasion capabilities.

“Dolphin is another addition to ScarCruft’s extensive arsenal of
backdoors abusing cloud storage services,” Jurčacko said. “One
unusual capability found in prior versions of the backdoor is the
ability to modify the settings of victims’ Google and Gmail
accounts to lower their security, presumably in order to maintain
account access for the threat actors.”