Tick Group Weaponized Secure USB Drives to Target Air
Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.
Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.
- Tick targeted ITSCC-certified secure USB drives from a South Korean defense company, an uncommon weaponization approach.
- SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems.
- Trojanized Korean and Japanese software delivered HomamDownloader and SymonLoader via spearphishing attachments.
- Unit 42 believes the attacks occurred years ago and the malware is not part of an active campaign.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 User Execution: Malicious FileT1091 Replication Through Removable Media
- Vendors
- Palo Alto NetworksMicrosoft
- Products
- Windows XPWindows Server 2003
- Threat actors
- Tick
- Organizations
- ITSCC
- Countries
- JapanSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | englandprevail.com | alicious files from the remote C2 server; in this case, pre.englandprevail[.]com. Trojanized Legitimate Software SHA256 Movie Player insta |
| sha256 | 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e | dca2c2b8dfea34e6f3f723274d88890f6ceb HomamDownloader SHA256 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62b |
| sha256 | 31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8 | 61352ef4f084d969dd30719166b47fdb204828a SysmonLoader SHA256 31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8 Mutex SysMonitor_3A2DCB47 File Path %ProgramFiles%\Windows |
| sha256 | 3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6 | ee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd2 |
| sha256 | 33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb | 269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb Table 1 Trojanized Korean programs During our investigation |
| sha256 | 8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a | of this file. Trojanized Legitimate Software SHA256 GO Game 8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a Table 2 Trojanized Japanese language program Despite the di |
| sha256 | 92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78 | 3bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2 |
| sha256 | b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa | rojanized Legitimate Software SHA256 Movie Player installer b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245 |
| sha256 | ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 | 4898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602 |
| sha256 | f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec | 25c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec C2 of HomamDownloader pre.englandprevail[.]com |
From the original article
9 min read at unit42.paloaltonetworks.com
Tick is a cyberespionage group primarily targeting organizations in Japan and the Republic of Korea. The group is known to conduct attack campaigns with various custom malware such as Minzen, Datper, Nioupale (aka Daserf), and HomamDownloader. Unit 42 last wrote about the Tick group in July 2017 .
By Mike Harbison, Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.