North Korean Group Seen Snooping on Russian Foreign Ministry

A North Korean espionage group deployed information-stealing malware on a Russian government-owned software to spy on the country’s foreign ministry officials, according to security researchers tracking an ongoing snooping campaign against Russia.

See Also: User Entity & Behavior Analytics 101: Strategies to Detect Unusual Security Behaviors

Researchers at Berlin-based cybersecurity company DCSO said the hackers had injected a decade-old malware product called KONNI into an installer for Statistika KZU, a Russian-language application used exclusively by the Russian Ministry of Foreign Affairs to relay statistical diplomatic information from overseas consulates to ministry headquarters.

The software, developed by Russian aerospace research company GosNIIAS, enables consulates to send annual reports about consular activities, procurement orders, annual expenses and Russian citizens living out of the country.

The cyberespionage group, tracked as the Konni Group and TA406, obtained installer packages for Statistika KZU and integrated the Konni malware into the installation process. When downloaded, the malware detects the operating system and deploys the appropriate payload and a batch file that sets up a “Windows Image Acquisition Service,” similar to a legitimate Windows service, for simultaneous persistence and execution.

Once the installation is complete, the cyberespionage group interacts with the malware to execute commands, upload and download files and specify sleep intervals. According to DCSO researchers, the Konni variant features limited capabilities compared to the 2016 variant, which featured remote administration and a variety of stealer functionality.

Espionage Activity Against Russia on the Rise

The latest campaign of the cybercriminal group targeting the Russian foreign ministry dates back at least to 2021. According to cybersecurity company Lumen, the group spoofed foreign ministry portals in phishing emails to harvest the credentials of ministry officials.

The group also used COVID-themed phishing emails to lure foreign ministry officials to click on malicious URLs impersonating the Department of Health and Health Service. When clicked, the URLs downloaded several files, including a fake version of the Russian-mandated vaccination registration software.

The hackers eventually compromised the email account of a foreign ministry staff member and used it to target the Russian Embassy in Indonesia and a deputy minister. According to cybersecurity company DuskRise, the Konni Group used the compromised foreign ministry email account to send a Trojanized .zip file to the embassy in Indonesia, making it appear as if the email had been sent from the Russian Embassy in Serbia.

DCSO researchers said the Konni Group, working in sync with other North Korean cyberespionage groups such as the Kimsuky Group and APT37, frequently targeted Russian government organizations despite the two countries having developed close ties in recent years.

“Increasing strategic proximity would not be expected to fully overwrite extant [North Korean] collection needs, with an ongoing need on the part of the DPRK to be able to assess and verify Russian foreign policy planning and objectives,” the firm said.

“The sample we uncovered, therefore, appears to fit into an established pattern of KONNI deployment against Russian foreign policy targets, with the 2021 campaign uncovered by Lumen and Cluster25 researchers appearing to be particularly similar in its execution and targeting.” The cybersecurity company revealed in October that the Konni Group had injected the Konni malware into an installer for Russian tax filling software Spravki BK.

Recent threat hunting data indicates the espionage group does not limit itself to targeting Russian government entities. Securonix Threat Labs reported in July that the group had used Konni malware with spear-phishing emails to target high-value targets in the Czech Republic, Poland and other countries.

According to Microsoft, the North Korean regime has engaged several cybercriminal groups to keep a close eye on the Russian government and defense industry. In 2023 alone, North Korean groups targeted an aerospace research institute, a university and several diplomatic government entities.

“North Korean threat actors may be capitalizing on the opportunity to conduct intelligence collection on Russian entities due to the country’s focus on its war in Ukraine,” the company said.

According to Sentinel Labs, DPRK-affiliated cyber groups Lazarus and ScarCruft targeted Russian missile manufacturing company NPO Mashinostroyeniya, which possesses “highly confidential intellectual property on sensitive missile technology currently in use and under development for the Russian military.”

It’s unclear if the cyberespionage operations will affect relations between the two countries, but the Russian intelligence community is aware of the scale of the threat. Russian cybersecurity company Solar Group said in November that cyberattacks by Asian hackers had surged in 2023, accounting for 20% of all cyber incidents and posing the most serious threat to Russian organizations.

“Their danger lies in the fact that it is almost impossible to determine the points of penetration of hackers into a company’s infrastructure without specialized expertise: The attackers either cover their tracks too well, or have been in the infrastructure for so long that it is not possible to find them,” Solar Group said. “The main goal of groups of this type is cyber espionage and data theft, and their main victims are the telecom industry and the public sector.”

The company said North Korea’s Lazarus Group has been consistently targeting Russian organizations. “Over the past two years, Solar 4RAYS experts have investigated several related incidents. Among the victims were, in particular, government authorities. At the same time, analysis of sensor data showed that at the beginning of November, Lazarus hackers still have access to a number of Russian systems,” Solar Group said.