NK-linked InkySquid APT leverages IE exploits in recent attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1380 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine | 7.8 | 24% | KEV | KEV |
| CVE-2021-26411 | Use-After-Free Memory Corruption in Microsoft Internet Explorer Exploited in the Wild | 8.8 | 82% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dailynk.com | ks aimed at the Daily NK South Korean online newspaper (www.dailynk[.]com). APT37 has been active since at least 2012, it mainly ta |
| domain | jquery.services | was loaded via www.dailynk[.]com to malicious subdomains of jquery[.]services . Below some examples of URLs used to load malicious code |
| url | https://www.dailynk.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 | dailynk[.]com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 The attackers modified the content of legitimate files us |
| url | https://www.dailynk.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 | . Below some examples of URLs used to load malicious code: hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery-mi |
From the original article
3 min read at securityaffairs.com
North Korea-linked InkySquid group leverages two Internet Explorer exploits to deliver a custom implant in attacks aimed at a South Korean online newspaper.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.