{"id":5037,"date":"2022-12-01T13:43:59","date_gmt":"2022-12-01T12:43:59","guid":{"rendered":"https:\/\/bezpecnevofirme.eset.com\/sk\/?p=5037"},"modified":"2022-12-01T13:47:56","modified_gmt":"2022-12-01T12:47:56","slug":"eset-odhalil-sofistikovany-backdoor-dolphin-z-dielne-skupiny-napojenej-na-kldr","status":"publish","type":"post","link":"https:\/\/bezpecnevofirme.eset.com\/sk\/cybernews\/eset-odhalil-sofistikovany-backdoor-dolphin-z-dielne-skupiny-napojenej-na-kldr\/","title":{"rendered":"ESET odhalil sofistikovan\u00fd backdoor Dolphin z dielne skupiny napojenej na K\u013dDR"},"content":{"rendered":"\n
\"ScarCruft<\/figure>\n\n\n\n
<\/div>\n\n\n\n

V\u00fdskumn\u00edci spolo\u010dnosti ESET odhalili doposia\u013e nezdokumentovan\u00fd backdoor Dolphin z dielne skupiny ScarCruft, ktor\u00e1 m\u00e1 bl\u00edzko k severok\u00f3rejsk\u00e9mu re\u017eimu. Malv\u00e9r sa vyzna\u010duje mnoh\u00fdmi \u0161pion\u00e1\u017enymi schopnos\u0165ami, vr\u00e1tane monitorovania diskov a pripojite\u013en\u00fdch zariaden\u00ed, exfiltrovania citliv\u00fdch s\u00faborov, vyhotovovania sn\u00edmok obrazovky a\u00a0kradnutia prihlasovac\u00edch \u00fadajov z\u00a0prehliada\u010dov. \u00a0<\/p>\n\n\n\n

Obete si vytipovali na juhok\u00f3rejskom spravodajskom port\u00e1li<\/h3>\n\n\n\n

Severok\u00f3rejsk\u00e1 APT skupina<\/a><\/strong> za\u010dala \u00fatok, v r\u00e1mci ktor\u00e9ho bol pou\u017eit\u00fd backdoor Dolphin, e\u0161te za\u010diatkom roka 2021. Na za\u010diatku bol takzvan\u00fd watering-hole \u00fatok na juhok\u00f3rejsk\u00fd spravodajsk\u00fd port\u00e1l, ktor\u00fd \u010ditate\u013eov informoval najm\u00e4 o dian\u00ed v K\u013dDR. Podstata watering-hole \u00fatoku spo\u010d\u00edva v tom, \u017ee \u00fato\u010dn\u00edk predpoklad\u00e1, na ak\u00e9 miesto pr\u00edde obe\u0165 a tam ju zasiahne. <\/p>\n\n\n\n

Skupina zameran\u00e1 na Ju\u017en\u00fa K\u00f3reu<\/strong>

Skupina ScarCruft, tie\u017e zn\u00e1ma ako APT37 alebo Reaper, je \u0161pion\u00e1\u017ena skupina akt\u00edvna najmenej od roku 2012. Zameriava sa najm\u00e4 na Ju\u017en\u00fa K\u00f3reu, ale zasiahla u\u017e aj \u010fal\u0161ie \u00e1zijsk\u00e9 krajiny. APT skupina sa pod\u013ea v\u0161etk\u00e9ho zauj\u00edma najm\u00e4 o\u00a0vl\u00e1dne a\u00a0vojensk\u00e9 organiz\u00e1cie, ale aj o\u00a0ostatn\u00e9 firmy z\u00a0r\u00f4znych odvetv\u00ed, ktor\u00e9 s\u00fa v\u00a0h\u013ead\u00e1\u010diku severok\u00f3rejsk\u00e9ho re\u017eimu.<\/p>\n\n\n\n

V tomto pr\u00edpade sa \u00fato\u010dn\u00edci zamerali pr\u00e1ve na n\u00e1v\u0161tevn\u00edkov port\u00e1lu. Samotn\u00fd \u00fatok pozost\u00e1val z viacer\u00fdch prvkov, vr\u00e1tane zneu\u017eitia zranite\u013enosti v\u00a0prehliada\u010di Internet Explorer a\u00a0shellcodu ved\u00facemu k\u00a0backdooru pomenovan\u00e9mu ako BLUELIGHT. Prv\u00e9 spr\u00e1vy nasved\u010dovali tomu, \u017ee backdoor BLUELIGHT predstavuje fin\u00e1lnu f\u00e1zu oper\u00e1cie. <\/p>\n\n\n\n

V\u00fdskumn\u00edci spolo\u010dnosti ESET v\u0161ak pri hlb\u0161ej anal\u00fdze zistili, \u017ee backdoor BLUELIGHT je iba predvojom pre druh\u00fd, e\u0161te sofistikovanej\u0161\u00ed backdoor Dolphin. Uk\u00e1zalo sa, \u017ee prv\u00fd backdoor BLUELIGHT je ur\u010den\u00fd na spustenie backdooru Dolphin. Priebeh \u00fatoku podrobnej\u0161ie popisuje sch\u00e9ma. <\/p>\n\n\n\n

<\/p>\n\n\n

\n
\"ScarCruft
Sch\u00e9ma \u00fatoku skupiny ScarCruft s pou\u017eit\u00edm backdooru Dolphin<\/figcaption><\/figure>\n<\/div>\n\n\n

Backdoor Dolphin sa zameriava len na vybran\u00e9 obete<\/h3>\n\n\n\n

Anal\u00fdza uk\u00e1zala, \u017ee k\u00fdm backdoor BLUELIGHT m\u00e1 na starosti z\u00e1kladn\u00fd prieskum a\u00a0zhodnotenie skompromitovan\u00e9ho zariadenia, sofistikovanej\u0161\u00ed backdoor Dolphin je\u00a0manu\u00e1lne nasaden\u00fd v\u00fdhradne na vybran\u00e9 obete. Oba backdoory dok\u00e1\u017eu vyn\u00e1\u0161a\u0165 s\u00fabory z\u00a0lokal\u00edt \u0161pecifikovan\u00fdch v\u00a0pr\u00edkaze, no Dolphin taktie\u017e akt\u00edvne preh\u013ead\u00e1va disky a\u00a0automaticky z\u00a0nich kradne s\u00fabory v\u00a0ur\u010ditom form\u00e1te.<\/p>\n\n\n\n

V\u00fdskumn\u00edci spolo\u010dnosti ESET pomenovali malv\u00e9r ako Dolphin pod\u013ea n\u00e1zvu adres\u00e1ra, v ktorom ho \u00fato\u010dn\u00edci mali ulo\u017een\u00fd. Od prv\u00e9ho odhalenia malv\u00e9ru Dolphin z apr\u00edla 2021 zaznamenali v\u00fdskumn\u00edci spolo\u010dnosti ESET viac verzi\u00ed tohto backdooru, ktor\u00e9 \u00fato\u010dn\u00edci postupne vylep\u0161ovali, aby sa pok\u00fasili vyhn\u00fa\u0165 detekcii. <\/p>\n\n\n\n

\u201ePo nasaden\u00ed na vybran\u00e9 ciele backdoor preh\u013ead\u00e1va disky skompromitovan\u00fdch syst\u00e9mov na pr\u00edtomnos\u0165 zauj\u00edmav\u00fdch dokumentov, ktor\u00e9 n\u00e1sledne vynesie na \u00falo\u017eisko Google Drive. Jednou z\u00a0nezvy\u010dajn\u00fdch schopnost\u00ed, ktor\u00fa sme na\u0161li v\u00a0predo\u0161l\u00fdch verzi\u00e1ch backdooru, je mo\u017enos\u0165 zmeni\u0165 nastavenia v\u00a0Google a\u00a0Gmail \u00fa\u010dtoch obet\u00ed s\u00a0cie\u013eom zn\u00ed\u017eenia ich zabezpe\u010denia. \u00dato\u010dn\u00edci si tak pravdepodobne chc\u00fa udr\u017ea\u0165 pr\u00edstup k\u00a0Gmail \u00fa\u010dtom,\u201c<\/em> hovor\u00ed Filip Jur\u010dacko, v\u00fdskumn\u00edk spolo\u010dnosti ESET, ktor\u00fd analyzoval backdoor Dolphin. <\/p>\n\n\n\n

\u010co dok\u00e1\u017ee backdoor Dolphin? <\/h3>\n\n\n\n