North Korean APT InkySquid Infects Victims Using Browser Exploits
volexity.com · 17 Aug 2021 · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2021-26411Microsoft Internet Explorer Memory Corruption Vulnerability81.7%Top 0.36%83.0priority
- CVE-2020-1380Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 7.8T1189Drive-by CompromiseT1203Exploitation for Client Execution2 reports24.2%Top 2.1%59.2priority
Where it names them
CVE-2021-26411 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2021-26411
On another occasion, CVE-2021-26411 was used, which is another exploit targeting Internet Explorer and legacy versions of Microsoft Edge.
CVE-2020-1380 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2020-1380
The first time Volexity was able to identify malicious code being returned, the attacker was observed using CVE-2020-1380, an exploit for Internet Explorer.
Implementation of CVE-2020-1380
This code corresponds to publicly available proof-of-concept (PoC) code for CVE-2020-1380 that has been well documented by TrendMicro.
The redirect code was set up in the same way as CVE-2020-1380, the only difference being the exploit code used.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.