Threat Actors Use New Exfiltration Tool: ReconShark

A North Korean state-sponsored threat actor, Kimsuky, is using a new reconnaissance tool called ReconShark as part of an ongoing global campaign. Kimsuky is known for its targeted attacks on organizations across North America, Asia, and Europe.

ReconShark is actively delivered to specifically targeted individuals through spear-phishing emails and the execution of malicious macros. The main responsibility of ReconShark is to exfiltrate information about the infected platform, such as running processes, information about the battery connected to the system, and deployed endpoint threat detection mechanisms.

Once the tool is successfully deployed on a system, it primarily functions as a recon tool to execute instructions sent from an actor-controlled server. It exfiltrates details about running processes, such as deployed detection mechanisms and hardware information. This data is then used to carry out “precision attacks” involving malware tailored to the targeted environment in a manner that sidesteps detection.

ReconShark can also deploy additional payloads from the server based on “what detection mechanism processes run on infected machines.” This means that the tool can be used to conduct extended periods of time for gathering intelligence while remaining undetected.

Acreto Solution

Acreto prevents the use of ReconShark by isolating systems, scanning encrypted communications and implementing content controls by allowing only specified file types to be transferred. Limiting access to communication channels, detecting and blocking any malicious content embedded in the communications offers many layers of defense that all contribute to protecting systems and infrastructures.

Acreto’s Isolated Data Flows limit access to specified sources and destinations, network protocols and ports, application protocols, and application programs. By limiting access to these areas, organizations can effectively block ReconShark from exfiltrating information and communicating with the server.

By using Acreto’s Ecosystems, which deliver a dedicated security infrastructure, organizations can limit access only to users, devices, systems, and applications that need to interoperate together. This limits ReconShark’s ability to communicate with the actor-controlled server and prevents it from deploying additional payloads.

Acreto’s Encrypted Secure Scan can decrypt, scan, and re-encrypt communications inline and in real-time. This helps in detecting and blocking any malicious content embedded in the encrypted payload, preventing phishing and exfiltration of data.

 

Ecosystem Security Isolation

Ecosystems deliver a dedicated security infrastructure that can be deployed per application, use-case, project or third-party. An Ecosystem inherently limits access only to users, devices, systems and applications that need to interoperate together.

Ecosystems support any technology, on any network, anywhere in the world. These include computers, mobile devices, IoTs, Offices, Clouds, SaaS and Data Centers.

Ecosystems can be configured as:

Eliminate the Internet Attack Surface

Eliminates any and all access from the Internet while Ecosystem members can interoperate with authorized systems and applications.

Eliminate the Internal Attack Surface

Ecosystems can easily isolate individual or groups of systems on a shared network or entire networks, to limit access only to systems that need to interoperate together. This is done with

Isolated Data Flows

Isolated data flows can be defined between two Ecosystem members to limit access to specified sources and destinations, network protocols and ports, application protocols as well as application programs.

Encrypted Secure Scan

Secure Scan addresses a key weakness in many security tools today. 90%+ of all communications is encrypted, yet only 10% of organizations have the means to secure these communications. Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time.

Any malicious content embedded in the encrypted payload is blocked, otherwise the clean and validated communication is delivered to its final destination.

Controls

Threat Prevention

After verification of network protocol, port, application protocol and application program, a deep inspection is performed on all communications. The effectiveness of this method is amplified by inline Encrypted Secure Scan. Threat prevention capabilities utilize two key methods:

Simplicity

Acreto Ecosystems are very easy to provision and deploy. There are no hardware dependencies or associated logistics.

Provisioning an Ecosystem takes 3-5 minutes. Simply provide a unique name to the Ecosystem then choose the bandwidth desired and within a few minutes your Ecosystem providing a dedicated security infrastructure is ready.

Depending on your connection options for Ecosystem members, deployment can take between 10 minutes to a few hours.

Sustainability

Acreto Ecosystems utilize a sustainable model without any dependency on products and their associated logistics. There are no more updates, upgrades or technology refreshes.

Change Management

Different Ecosystems operate completely independently from one-another. Therefore, change management impacts only members of a specified Ecosystem, not the entire organization. This simplifies the traditionally complex change management process.

Policy Management

Policy management also benefits from Ecosystems. Because Ecosystems are specific to a customer scenario such as an application, use-case, project or third-party, all policies apply to the scenario. Moreover, when its time for policy cleanup, when an application or use-case is retired, disabling or deleting the Ecosystem automatically prunes the policies. This has traditionally been a complex task that is at best inaccurate.

 

Mechanism of Attack

• ReconShark actively delivered through spear-phishing emails and the execution of malicious macros.

• Most recently, they made use of Microsoft OneDrive to host the malicious document for download.

• Kimsuky entices the target to open a link to download a password-protected document.

• The lure documents contain Microsoft Office macros that activate on document close, which implement a newer variant of the reconnaissance capability of Kimsuky’s BabyShark malware.

• Once ReconShark is successfully deployed on a system, it primarily functions as a recon tool to execute instructions sent from an actor-controlled server.

• The main responsibility of ReconShark is to exfiltrate information about the infected platform.

• ReconShark is also capable of deploying additional payloads from the server based on “what detection mechanism processes run on infected machines.”

• Unlike previous variants, ReconShark does not save the harvested information on the file system but instead stores the data in string variables and uploads it to the C2 server by issuing HTTP POST requests.

• The data gathered from ReconShark is used to carry out “precision attacks” involving malware tailored to the targeted environment in a manner that sidesteps detection.

• ReconShark is designed to conduct extended periods of time for gathering intelligence while remaining undetected.

 

About Acreto

Acreto delivers full-stack cybersecurity without products, logistics or significant security expertise. It creates and consolidates the best of cybersecurity into a single plug-and-play platform with automated updates to stay ahead of threats. Acreto activates enterprise-grade security instantly, so organizations can run safely, easily, and without interruption.