Sunshop group linked to espionage attacks

By

The IE exploit was recently used in watering hole.

An espionage group is spreading a remote access trojan (RAT) and other malware with the help of three recently patched vulnerabilities in Java and Internet Explorer.


The Sunshop Group collective was behind the malicious activities and had compromised several websites including those owned by the Korean military and strategy think tanks,  according to FireEye researcher Ned Moran.

The IE zero-day was the same exploit used earlier this month in a watering hole attack against the US Department of Labor website.

The agency removed the compromised pages and the vulnerabilities were since patched.

Moran said the Sunshop Group also infected the Nobel Peace Prize's website back in 2010 using a Firefox zero-day in that instance.

In recent Sunshop attacks, users visiting compromised sites were redirected to a malicious page at a site called Sunshop – hence researchers' name for the group.

That site served victims a RAT known as Lady Boyle and additional malware, which include backdoor trojans.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Log In

  |  Forgot your password?