Hacker, researcher, human rights activist combating APTs, gov'ts, surveillance, privacy violations & corporate greed. Hacking & RE s'ware, malware & exploits.
Aug 24, 2023 โข 15 tweets โข 4 min read
The Korean Military's mandatory phone application for all soldiers.
At the start of the year, I found two vulnerabilities in this application that would leak GPS locations of soldiers. The Korean ministry of defense refused to acknowledge my findings. All the details --๐งต1/n
The Military application called ๊ตญ๋ฐฉ๋ชจ๋ฐ์ผ๋ณด์ (Defense Mobile Security) has three different versions. They are for soldiers (employees), staff (civil servants) & external contractors. They applications are intended to use NFC and bluetooth to allow enter military sites --๐งต2/n
We (@interlab_kr) have been tracking a threat actor we classify as UCID902. This actor is utilising watering hole credential harvesting attacks to target activists related to the advocacy of human rights in the Korea peninsular.
We first observed UCID902 in 2021 when working with activists based in SK and with lures aimed to appear as Naver security alerts, prompting users to input credentials. We found that typical infrastructure was set up on legitimate web development organisations web servers.
Apr 13, 2023 โข 7 tweets โข 3 min read
@hypen1117 Hey Hypen. Thanks kindly for your message. Great to have civil discussion on it! Like I said, I donโt think it really matters. I value your teams research more than this matter, you have done a great thing to society by finding differing versions of RambleOn 1/@hypen1117 Our analysis was a finding of novel malware that was impacting journalists at that present moment. We found RambleOn then imminently went to work on working with big tech to implement detections and mitigations for it, to better defend society and those at risk 2/
Apr 12, 2023 โข 6 tweets โข 3 min read
Weโve identified further, clear connections between #RambleOn Android malware and #APT37.
In 2022 we uncovered a new novel Android malware campaign targeting journalists working on the advocacy of NK human rights at @nknewsorg.
๐งต1/6
Last month @S2W_Official published additional research on #RambleOn, finding other variants of it and highlighting code similarities between a 2017 campaign operated by #APT37 which used a Android variant of #Rokrat Malware
2/6
