An ambush for peculiar KoreansWhile researching PlugX propagation with the use of Java exploits we stumbled upon one compromised site that
hosted and pushed a malicious Java applet exploiting the CVE 2013-0422 vulnerability. The very malicious Java
application was detected heuristically with generic verdict for that vulnerability and it would have been hardly
possible to spot that particular site between tons of other places where various malicious Java applications were
detected with that generic verdict. But it was a very specific search conducted back then and this site appeared in
statistics among not so many search results. Well, to be honest it was a false positive in terms of search
criteria, but in this case it was a lucky mistake.
The infectious website was an Internet resource named - minjok.com and it turned out to be a news site in
Korean and English languages covering mostly political events around the Korean peninsula. We notified an editor of
this site about the compromise and although he has not responded, the site got closed after a while.
This is how minjok.com is described at http://www.northkoreatech.org/the-north-korean-website-list/minjok-tongshin/:
Description of minjok.com
Source:
An ambush for peculiar Koreans
