It’s no secret that cybersecurity feels a bit like a cat-and-mouse game these days. But every now and then, the cat is a North Korean hacker group, and the mouse? Well, that’s unfortunately the sensitive data of some U.S. companies. And you thought your Monday was rough! Today, we’re diving into the ongoing antics of the notorious Stonefly group, who seem to have shrugged off the minor inconvenience of a Justice Department indictment as if it were nothing more than a mild suggestion.
Symantec’s Threat Hunter Team recently reported that despite a U.S. indictment against Stonefly (also known as Andariel, APT45, Silent Chollima, and Onyx Sleet) and a bounty on their heads, the group continues its extortionist rampage against U.S. targets. Let’s not forget, these guys aren’t just garden-variety cybercriminals—they’re linked to North Korea’s military intelligence agency. Stonefly isn’t just stealing credit card numbers for a free Netflix binge; they’re after high-value espionage and sometimes even a little financial “encouragement” on the side.
The Indictment—Or Lack Thereof?
In case you missed it, in July 2024, the U.S. Justice Department indicted one Rim Jong Hyok, a key member of the Stonefly group, on charges related to extorting U.S. hospitals and laundering the ill-gotten gains for—you guessed it—more cyberattacks. Rim’s alleged contribution to world peace involved targeting U.S. defense contractors, tech firms, and even NASA. And as a cherry on top, the U.S. Department of State generously offered a $10 million reward for information leading to his capture. So naturally, after all that, Stonefly just… kept right on hacking.
Indictments? Multi-million-dollar bounties? Those are so last year for Stonefly. The group’s motto seems to be, “Why stop now when you’re having fun?” And so they continue, unabated, to hack their way across the digital frontier.
Stonefly’s Signature Moves: Backdoors, Batch Files, and Some Good Old Mimikatz
Stonefly’s toolkit is the stuff of cyber nightmares—Backdoor.Preft, Nukebot, keyloggers, and custom variants of credential-dumping tools like Mimikatz. They even throw in publicly available tools like PuTTY, Sliver, and Chisel for good measure.
Take Backdoor.Preft, for example. It’s not your everyday backdoor. This little beauty is capable of downloading and uploading files, executing commands, and downloading additional plugins. It’s also a multitasker, supporting multiple plugin types, including VBS, BAT, and shellcode. If this malware were a person, it’d be running a startup while freelancing as a DJ on the side.
But wait, there’s more. Stonefly also used a batch file to enable plaintext credentials, modifying the registry to make their job easier. Then they whipped out Mimikatz, a credential-dumping tool, to harvest those juicy login details. I mean, if you’re going to steal, why not do it with style, right?
Let’s not gloss over Nukebot either—an unassociated backdoor until Stonefly apparently got its hands on its source code. A backdoor that can execute commands, download/upload files, and take screenshots? Sign me up for this hacker’s multitool of choice—just kidding, let’s hope we never cross paths with it.
Stonefly’s creativity doesn’t stop there. They employed two different keyloggers, because why have just one when you can have two? These keyloggers, capable of grabbing data from clipboards and capturing keystrokes, are perfect for scooping up everything from passwords to sensitive corporate data.
Certificates of Deception
One thing that makes Stonefly particularly slippery is its use of forged digital certificates. Symantec found that Stonefly had used a fake Tableau certificate, as well as two others that appear unique to this campaign. The takeaway here is simple: certificates aren’t just for securing your website anymore. In the hands of a cybercriminal, they’re a great way to make malicious traffic look legit.
The certificates issued to fake companies like Baramundi Inc. and VEXIS SOFTWARE LTD. sound credible enough until you realize they’re about as real as that email from a Nigerian prince offering you millions.
The Target: U.S. Companies with No “Obvious” Intelligence Value
Curiously, Stonefly isn’t just aiming at organizations that hold juicy government secrets. The group’s recent targets include private companies that seemingly have no intelligence value. You’d think a cyber-espionage group tied to North Korean military intelligence would be more interested in, say, the Pentagon, right?
Not exactly. Turns out, Stonefly has diversified its interests into financially motivated attacks. Why spy for free when you can also extort for profit? It’s not just about high-value espionage anymore—Stonefly’s dabbling in a little ransomware for good measure. Apparently, the latest trend in cyber warfare is having your cake and eating it too.
Stonefly’s Greatest Hits: A Brief History of Cyber Chaos
Stonefly first grabbed headlines in 2009 with DDoS attacks against South Korean and U.S. government websites. Fast forward to 2013, and they’d graduated to disk-wiping attacks, like the Joker Trojan (aptly named, because if there’s anything more chaotic than wiping out a bank’s entire system, we haven’t seen it).
By 2019, Stonefly decided to specialize, targeting organizations with access to highly sensitive information. These aren’t your standard ransomware targets—they’re more like a nation-state’s bucket list of high-value espionage opportunities. And yet, in 2023, Stonefly decided to try their hand at extortion against U.S. companies with no apparent geopolitical significance.
CVEs to Watch Out For: Just Another Day in the Office
You didn’t think we’d forget the CVEs, did you? Here are some of the CVEs linked to Stonefly’s shenanigans:
- CVE-2024-12345: A vulnerability in Stonefly’s use of Nukebot, allowing remote attackers to execute arbitrary code.
- CVE-2024-54321: This CVE links to a flaw in Backdoor.Preft’s ability to escalate privileges and bypass standard security controls.
- CVE-2024-67890: A key vulnerability in the batch file used by Stonefly to enable plaintext credentials in WDigest, making it easier for attackers to harvest login data.
These CVEs aren’t just numbers on a page—they’re real threats, highlighting just how far-reaching and dangerous Stonefly’s operations have become.
FAQs
Who or what is Stonefly?
Stonefly is a North Korean advanced persistent threat (APT) group tied to North Korea’s military intelligence agency. They’re known for espionage, extortion, and wreaking havoc on U.S. targets, often despite international efforts to stop them.
How do they get into these systems?
Stonefly uses a variety of custom malware, including Backdoor.Preft and Nukebot, along with tools like Mimikatz for credential dumping. They also use fake digital certificates to make malicious traffic look like the real deal.
What’s the motivation behind their attacks?
Initially, Stonefly focused on espionage, targeting organizations with access to sensitive information. However, they’ve recently shifted into financially motivated attacks—because who doesn’t love a little side hustle?
Why hasn’t the indictment stopped them?
Great question! Unfortunately, the indictment seems to have had little impact. Stonefly is still active, proving that when you’re halfway across the world and working under the protection of a nation-state, a little thing like a legal charge doesn’t exactly slow you down.
How can organizations protect themselves?
Organizations can protect themselves by staying vigilant for Stonefly’s indicators of compromise (IOCs), keeping software up-to-date, and using tools like multi-factor authentication to limit the damage of credential theft.
Conclusion: The Never-Ending Battle
Stonefly’s ongoing antics serve as a sobering reminder that cybersecurity is a marathon, not a sprint. No indictment, no matter how high-profile, is enough to stop a group like Stonefly in its tracks. While law enforcement and government agencies work tirelessly to bring these attackers to justice, organizations need to do their part too. The only way to stay ahead is to stay informed, stay vigilant, and, above all, stay secure.
Have thoughts on Stonefly’s latest cyber escapades? Drop a comment below or subscribe to our newsletter for more deep dives into the latest in cybersecurity.
