A new strain of malware that infiltrates Korean users' PCs through emails impersonating Microsoft's security team has been discovered. Suspected to be the work of a North Korea-linked hacking group, the malware was analyzed as capable of recording keyboard input as well as capturing screens and recording microphone audio, requiring special caution.
According to domestic security firm Genians on Tuesday, malware called "NarwhalRAT," presumed to be the work of the North Korea-linked hacking group APT37, has recently been distributed targeting Korean users.
The attack begins with a spear-phishing email disguised as a Microsoft account security alert. The email contained the message that "an abnormal sign of repeated generation of a one-time password (OTP) was detected in your Microsoft account."
While the sender name is displayed as "Microsoft Account Team," the actual sending domain was confirmed not to be Microsoft's official domain. The method targets the possibility that users will mistake it for a genuine security notice.
The email mentions the possibility of account theft and induces users to check the attached security notice. When the compressed file is unzipped, a malicious shortcut (.lnk) file that appears to be a Hangul document appears. When the file is executed, a normal-looking security notice document opens on the surface, but malware installation proceeds behind the scenes.
Evidence was also confirmed that the malware was designed to target the Korean user environment. Genians noted that after the malware is installed, it creates a folder named "naverwhale" inside the computer as its working directory.
The folder name "naverwhale" is interpreted as an intent to disguise itself as the Naver Whale browser, which is widely used in Korea. Genians named the malware "NarwhalRAT" by applying a rearrangement of characters that combines this name with "Narwhal."
The internal code also included logic that separately handles KakaoTalk-related windows as targets for information collection. By filtering out secondary windows to increase the accuracy of collected data, it shows the possibility that it was developed with the Korean user environment in mind.
NarwhalRAT can selectively execute various functions according to the attacker's remote commands. It was analyzed to have more than 30 functions, including keyboard input recording, screen capture, microphone recording, USB storage device file collection, and remote command execution.
Through this, it is structured to identify what programs a victim uses and what services they access on their PC through screens and keystrokes.
The collected data is not transmitted externally immediately but is temporarily stored in the working directory before being sent all at once. This is interpreted as a method to avoid real-time network detection.
Genians analyzed that this attack shows high similarity in structure and method to the Python-based backdoor attack case of the North Korea-linked hacking group APT37 disclosed in May last year.
According to the explanation, the final author name of the bait document used in the spear-phishing was identical as "Lailey," and the malicious shortcut file structure, batch file obfuscation method, and the method of securing persistence based on the task scheduler also largely matched.
Genians recommended that "since there is a possibility of continued use in similar variant forms in the future, behavior-based detection systems should be strengthened along with file-based detection."
