Atomic research institute breached via VPN vulnerability – Malwarebytes Labs

Remember when we told you to patch your VPNs already? I hate to say “I told you so”, but I informed you thusly.

According to South Korean officials a North Korean cyber-espionage group managed to infiltrate the network of South Korea’s state-run nuclear research institute last month.

The crime: time and place

Cybersecurity news hounds The Record report that a spokesperson for the Korea Atomic Energy Research Institute (KAERI) said the intrusion took place last month, on May 14 to be exact, through a vulnerability in a virtual private network (VPN) server. Since its establishment in 1959, KAERI has been the only research institute in Korea dedicated to nuclear energy. Reportedly, thirteen unauthorized IP addresses accessed KAERI’s internal network.

The suspect: Kimsuky

Some of the addresses could be traced back to the APT group called Kimsuky. One of the IP addresses was used in an attack that targeted COVID-19 vaccine developers in South Korea last year.

North Korean cyber-attacks on its southern neighbor are not uncommon. And Kimsuky is the APT that is best known for these attacks. The Kimsuky APT is a North Korean threat actor that has been active since 2012 and targets government entities mainly in South Korea. Recently, we reported about this group using the AppleSeed backdoor against the Ministry of Foreign Affairs of South Korea.

The victim: KAERI

KAERI is a national research institute which was instrumental in developing nuclear technology for power generation and industrial applications. And while North Korea is ahead of South Korea in some nuclear fields—notably nuclear weapons—it is thought to be weaker than its neighbor when it comes to energy generation. As we stated in our earlier report one of the other targets was the nuclear security officer for the International Atomic Energy Agency (IAEA), a UN organization tasked with nuclear regulations and cooperation.

The weapon: a VPN vulnerability

In a statement, KAERI says that an unidentified outsider accessed parts of its system using weaknesses in its virtual private network (VPN). It also states that the attackers’ IP addresses was blocked, and its system upgraded, when it found out about the attack, on May 31.

The name of the VPN vendor is being kept secret. Although we can’t rule out a zero-day, that fact that this wasn’t mentioned, and that the system was updated in response, suggests it wasn’t. It certainly doesn’t need to be, and there are a lot of known vulnerabilities in the running. Many of them are years old, and many are known to be used in the wild. Even though patches are available, the application of these patches has taken some organizations quite some time.

We also wrote recently about vulnerabilities in the Pulse Secure VPN. Pulse issued a final patch on May 3 for  a set of vulnerabilities that were used in the wild.

The NSA also issued an advisory in April about five publicly known vulnerabilities being exploited by the Russian Foreign Intelligence Service (SVR). The CVE numbers used to identify vulnerabilities start with year the CVE was issued. What’s most striking about the NSA’s list is just how old most of the vulnerabilities on it are.

As you can see, most of them are VPNs and other networking-related applications. By design a VPN is remotely accessible, which makes it a target that attackers can reach from anywhere. A VPN or gateway is always a likely target, especially if it has a known vulnerability. And a seasoned APT group, like Kimsuky, will have fewer problems reverse-engineering patches than your everyday cybercriminal.

Patching or lack thereof

The risky strategy of little-to-no-patching stands a good chance of going horribly wrong. A Forbes study of 340 security professionals in 2019 found 27% of organizations worldwide, and 34% in Europe, said they’d experienced breaches due to unpatched vulnerabilities. If an inability to patch promptly is compounded by delays in detecting new systems added to networks, and a lack of regular vulnerability scanning, attackers are left with a lot of room to work with.

Stay safe, everyone!