Korean AnySign4PC Software Flaw Exploited in Watering Hole Campaign

Originally published on CyberNetSec.

Executive Summary

A state-sponsored cyberespionage campaign is actively targeting users in South Korea through a sophisticated watering hole attack. Threat actors are compromising trusted South Korean websites and using them to exploit a vulnerability in AnySign4PC, a popular financial security software. The attack is highly effective as it requires no user interaction; anyone visiting a compromised site with a vulnerable version of AnySign4PC installed can be infected. The payload consists of backdoors identified as SIGNBT and COPPERHEDGE. Security firm AhnLab has identified attacks at 72 organizations and found 15 compromised websites used in the campaign. The Korea Internet & Security Agency (KISA) has advised users to update the software immediately.

Threat Overview

This campaign leverages a classic watering hole strategy: instead of targeting victims directly, the attackers compromise websites they are likely to visit.

Attack Chain:

1. Watering Hole Setup: The threat actor compromises legitimate, trusted websites in South Korea. Several of the compromised sites were reportedly managed by the same development company, suggesting a possible supply chain attack as the initial vector for compromising the sites.
2. Exploitation: When a user with a vulnerable version of AnySign4PC (1.1.4.4 through 1.1.4.6) visits one of these sites, malicious code on the site exploits the flaw in the security software.
3. Payload Delivery: The exploit is used to download and execute backdoors on the victim's system without any prompts or user interaction. This aligns with T1203 - Exploitation for Client Execution.
4. Persistence & C2: The installed backdoors, SIGNBT and COPPERHEDGE, establish persistence and connect to attacker-controlled infrastructure for further commands and data exfiltration.

AhnLab's research also found tactical overlaps with attacks that deployed Gunra ransomware, including shared vulnerabilities and infrastructure, but a definitive link to a single threat actor has not been made.

Technical Analysis

The core of the attack is the vulnerability in AnySign4PC. While a CVE ID has not yet been assigned, it appears to be a flaw that allows for remote code execution when parsing content on a webpage. This type of vulnerability in a security product is particularly dangerous because the software is expected to be trusted and runs with elevated privileges. The use of compromised but legitimate websites makes the attack difficult for users to detect, as they are not visiting overtly malicious domains. The malware deployed, SIGNBT and COPPERHEDGE, are likely custom backdoors designed for espionage, allowing the attackers to steal files, log keystrokes, and execute further commands on the compromised systems (T1059 - Command and Scripting Interpreter).

Impact Assessment

The impact of this campaign is primarily focused on espionage and data theft from targeted organizations in South Korea. By compromising systems within these organizations, the state-sponsored actor can gain long-term access to sensitive information. The use of a vulnerability in a mandatory security software creates a large pool of potential victims. The impact on an individual victim organization could include the loss of intellectual property, sensitive government or business data, and a persistent network intrusion that is difficult to eradicate.

---

IOCs — Directly from Articles

No specific technical Indicators of Compromise (IPs, domains, hashes) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams at organizations in South Korea should hunt for:

• Outbound Network Connections: Monitor for suspicious outbound connections from workstations to unknown IP addresses, especially from processes related to AnySign4PC or other browser helper objects.
• Suspicious File Creation: Look for newly created executable files in common temporary directories (%TEMP%, %APPDATA%) immediately following web browsing activity.
• DNS Queries: Hunt for DNS queries to newly registered or suspicious-looking domains that do not correspond to legitimate business activity.
• Software Inventory: Maintain an accurate inventory of all installed software and versions to quickly identify systems running vulnerable versions of AnySign4PC.

Detection & Response

1. Endpoint Detection: EDR solutions should be configured to monitor for suspicious process chains, such as a browser spawning a command shell or downloading and executing a new binary. This maps to D3-PA: Process Analysis.
2. Network Filtering: Use DNS filtering and web proxies to block connections to known malicious domains and newly registered domains that may be used for C2 infrastructure. This is an application of D3-OTF: Outbound Traffic Filtering.
3. Vulnerability Scanning: Scan all endpoints to identify installations of AnySign4PC versions 1.1.4.4 through 1.1.4.6.

Mitigation

1. Update Software: The primary mitigation is for all users and organizations to update AnySign4PC to the patched version 1.1.5.0 or later. Vulnerable versions should be uninstalled. This is a direct application of D3-SU: Software Update.
2. Browser Security: Ensure browsers are up to date and consider using ad-blockers or script-blockers to reduce the risk of drive-by compromise attacks, though this may impact the functionality of some sites.
3. Principle of Least Privilege: Users should not run with local administrator privileges for daily tasks. This can limit the impact of a successful exploit and prevent some malware from installing correctly.