Sunshop group linked to espionage attacks

An espionage group is spreading a remote access trojan (RAT) and other malware with the help of three recently patched vulnerabilities in Java and Internet Explorer.

The Sunshop Group collective was behind the malicious activities and had compromised several websites including those owned by the Korean military and strategy think tanks,  according to FireEye researcher Ned Moran.

The IE zero-day was the same exploit used earlier this month in a watering hole attack against the US Department of Labor website.

The agency removed the compromised pages and the vulnerabilities were since patched.

Moran said the Sunshop Group also infected the Nobel Peace Prize's website back in 2010 using a Firefox zero-day in that instance.

In recent Sunshop attacks, users visiting compromised sites were redirected to a malicious page at a site called Sunshop – hence researchers' name for the group.

That site served victims a RAT known as Lady Boyle and additional malware, which include backdoor trojans.

This article originally appeared at scmagazineus.com