Emailed Cyberattack Targets 2018 Pyeongchang Olympics

A fileless malware campaign was discovered targeting organizations associated with the upcoming 2018 winter Olympics being held in Pyeongchang, South Korea, report analysts at McAfee Advanced Threat Research. An unknown nation-state attacker is likely responsible.

The campaign's primary target was [email protected] with 337 South Korean organizations included on the BCC line. Most targets had some involvement in the Olympics, either in providing infrastructure or playing another supporting role.

This attack arrived as a spearphishing email containing a malicious Word attachment with the original file name "Organized by Ministry of Agriculture and Forestry and Pyeongchang Winter Olympics" (translated from Korean). Emails began on Dec. 22, 2017 with the most recent activity appearing on Dec. 28, when messages were sent from an IP address in Singapore.

Emails were disguised to appear to be from South Korea's National Counter-Terrorism Center (NCTC). At the time, the NCTC was conducting physical anti-terror drills to prep for the Olympics, which suggests the email is legitimate and increases the odds people will open it.

The malicious document, which contains an obfuscated Visual Basic macro, prompts recipients to open it in their version of Microsoft Word and launches a PowerShell script when "Enable Content" is clicked. Attackers used an open-source steganography tool Invoke-PSImage, released on Dec. 20, to hide malicious PowerShell code on a remote server.

This process ultimately delivers an implant, which creates an encrypted channel to the attacker's server and gives them the ability to execute commands on the victim's machine. The goal was to evade detection technologies that rely on pattern matching, researchers explain.

"Based on the use of fileless malware to weaponize steganography tools and quickly deploy it in an active attack … this is the work of a nation state," says McAfee senior analyst Ryan Sherstobitoff. At this time, there is no information to support which country is responsible.

Threat actors are casting a wide net, researchers report, and their choice of victim is significant.

"This is one notable incident where you have an attacker with the hallmarks of a nation state who took deliberate interest in conducting reconnaissance and identifying a number of targets involved with planning the winter Olympics," says Sherstobitoff.

General cybercriminals may use the upcoming Olympics as a lure to target consumers and make money, Sherstobitoff explains. This actor, with the intention of sneaking onto victims' machines, is more interested in understanding the events unfolding in the region.

"The attacker is getting an inside look at what's happening behind the scenes," Sherstobitoff says. While analysts haven't yet seen the full effect, he says this could be "potentially damaging." With the data collected, a threat actor could hold information for ransom, making it difficult to engage with them further, or cause embarrassment for the host country.

It's increasingly common to see in-memory implants using PowerShell and obfuscation to avoid detection, though researchers note this type of attack has not been previously seen targeting users in South Korea. Use of the steganography tool, which was used in this campaign less than a week after its release, implies the actors are savvy to new tools.

McAfee reports fileless threats continued to grow in Q3 and PowerShell malware grew by 119%. "The techniques [here] have significantly grown from being used infrequently to being used quite often," says Sherstobitoff. "This technique is interesting, especially when involved in high-profile, targeted attacks."

Many cyberattacks continue to exploit basic security vulnerabilities and user behavior; however, the rise in fileless threats shows more are abusing system vulnerabilities, says McAfee Labs vice president Vincent Weafer.

"By leveraging trusted applications or gaining access to native system operating tools such as PowerShell or JavaScript, attackers have made the development leap forward to take control of computers without downloading any executable files, at least in the initial stages of the attack," he says.

Related Content: