KRBanker Targets South Korea Through Adware and Exploit Kits
Unit 42 details KRBanker banking trojan targeting South Korean bank users via KaiXin exploit kit and NEWSPOT adware, using pharming and process hollowing.
KRBanker (aka Blackmoon) is a banking trojan targeting online banking users in the Republic of Korea, with roughly 2,000 unique samples and 200+ pharming servers observed by Unit 42 over six months. It is distributed through the KaiXin exploit kit exploiting Adobe Flash CVE-2014-0569 and CVE-2015-3133, and through the NEWSPOT adware update channel that also delivers the Venik trojan. The trojan uses process hollowing, retrieves pharming server IPs from Qzone profile nickname fields, and abuses Proxy Auto-Config with a local proxy to redirect banking traffic to forged sites.
- Distributed by KaiXin exploit kit exploiting Adobe Flash CVE-2014-0569 and CVE-2015-3133.
- NEWSPOT adware update channel installs KRBanker and Venik banking trojans.
- Uses process hollowing and Proxy Auto-Config abuse for pharming.
- Retrieves pharming server IPs from Qzone SNS API nickname fields.
- About 2,000 unique samples and 200+ pharming servers observed in six months.
- Vendors
- Palo Alto Networks
- Products
- NEWSPOT
- Organizations
- Palo Alto NetworksFortinetQzone
- Countries
- South Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-0569 | — | 92% | — | ||
| CVE-2015-3133 | — | 5% | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | newspot.kr | nd starts getting configuration from the following URL: www.newspot[.]kr/config.php?sUID=[web site name] It downloads a file from |
| domain | users.qzone.qq.com | user information by sending QQ number to the following URL. users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?uins=[QQ ID Number] The server |
| ipv4 | 23.107.204.38 | lowing is an example response that contains the IP address, 23.107.204[.]38 which is then extracted by KRBanker for Pharming. Figure |
From the original article
5 min read at unit42.paloaltonetworks.comOnline banking services have been a prime target of cyber criminals for many years and attacks continue to grow. Targeting online banking users and stealing their credentials has yielded huge profits for the criminals behind these campaigns. Unit 42 has been tracking "KRBanker" AKA 'Blackmoon', since late last year.
By Vicky Ray, Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.