North Korean Hackers Target Internet Explorer Vulnerability in Supply Chain Attack

A recently discovered zero-day vulnerability in Internet Explorer has once again exposed the persistent threat of cyber espionage. The latest victim? An advertising agency compromised by the notorious North Korean APT37 group, also known as RedEyes, Reaper, ScarCruft, Group123, and TA-RedAnt. This sophisticated attack highlights the group’s ability to exploit outdated technology, using a flaw in Internet Explorer to target users through supply chain vulnerabilities.

A Vulnerability Exploited in Plain Sight

Tracked as CVE-2024-38178, the vulnerability is tied to a memory corruption issue within Internet Explorer’s scripting engine. While Microsoft ended support for Internet Explorer in 2022, many applications, including advertising software, continue to rely on its underlying code to function. Specifically, the vulnerability exists within jscript9.dll, a browser engine component that remains embedded in software, leaving it vulnerable to attack.

According to AhnLab and South Korea’s National Cyber Security Center (NCSC), APT37 targeted the vulnerable browser engine to launch a zero-click attack. This means that users did not need to interact with malicious links or files for their systems to be compromised. The flaw allowed remote code execution, enabling the attackers to take control of affected machines simply through exposure to compromised advertisements.

How the Attack Unfolded

The attack began when APT37 compromised the advertising server of a Korean company behind the Toast ad program, which was bundled with various free software. The compromised server then distributed malicious ads through the ad program to systems running the vulnerable Internet Explorer engine. As these ads were downloaded and rendered, the malicious code was executed without any user interaction, resulting in a zero-click attack.

APT37 used this vulnerability as an entry point to deliver malware to the affected systems. This was likely part of a broader effort to target individuals involved in South Korean affairs, including defectors, activists, journalists, and policymakers.

Microsoft’s Patch and Ongoing Risks

Microsoft released a patch for CVE-2024-38178 on August 13, addressing the vulnerability by requiring users to click on a crafted URL. However, this patch came too late for the compromised advertising agency and its users. Even with this fix, the presence of Internet Explorer’s engine in legacy software remains a significant risk.

AhnLab warns that many applications continue to use Internet Explorer’s WebView component to render web content, making them vulnerable to this type of attack. The fact that a browser retired over two years ago is still being exploited underscores the importance of regularly updating software and replacing legacy systems.

Protecting Against Zero-Day Exploits

APT37’s exploitation of CVE-2024-38178 serves as a stark reminder of the need for organizations to stay vigilant against zero-day vulnerabilities, even in outdated software. Here are a few steps that businesses and individuals can take to reduce the risk of similar attacks:

• Regular Software Updates: Ensure that all software is up to date, and discontinue the use of outdated or unsupported applications.
• Monitor Indicators of Compromise (IoCs): AhnLab has published a report containing IoCs related to this attack. Organizations should monitor their networks for these indicators to detect any signs of compromise.
• Isolate Vulnerable Software: If certain applications rely on older, vulnerable software components, isolate them from the rest of your network to prevent the spread of malware in the event of an attack.

Lessons from APT37’s Persistence

APT37, also known as RedEyes, has a long history of targeting high-profile individuals and groups, often using zero-day vulnerabilities to gain access. Their latest campaign demonstrates that even after a decade of activity, they remain a significant cyber threat.

In today’s evolving cyber landscape, attacks like these are a reminder that the weakest link in the supply chain can cause widespread damage. Regular updates, awareness of known vulnerabilities, and robust security practices are essential defenses against advanced persistent threats like APT37.

As long as legacy software remains in use, cybercriminals will continue to exploit these hidden vulnerabilities. Staying ahead requires a proactive approach to cybersecurity—because the next zero-day exploit may be just around the corner.