RedEyes

RedEyes, also known as APT37, TA-RedAnt, Reaper, ScarCruft, Group123, InkSquid, BadRAT, and Ricochet Chollima, is a North Korea-linked threat actor known for its malicious cyber activities. It recently exploited an Internet Explorer zero-day vulnerability (CVE-2024-38178 with a CVSS score of 7.5) in a supply chain attack. The group has been observed using a new malware called FadeStealer to steal information from targeted systems and send it to a command-and-control (C2) server. RedEyes' attacks are typically aimed at specific individuals such as North Korean defectors, human rights activists, and university professors. In addition to exploiting vulnerabilities, the group has been spreading malicious emails related to Cambodian affairs in the Khmer language to lure targets. This strategy suggests a shift in tactics and demonstrates their adaptability. Moreover, they have been deploying CloudMensis malware that attempts to identify where SIP is disabled in order to load its own malicious database. While not considered highly sophisticated, this malware is designed to steal various information from compromised machines that can be used as stepping-stones for future attacks. ASEC and Securonix, among other cybersecurity entities, are actively monitoring the activities of the RedEyes group and taking steps to mitigate further damage. The state-sponsored group's recent use of an infostealer targeting North Korean defectors, human rights activists, and university professors underscores the persistent threat they pose. As these attacks continue, organizations are urged to remain vigilant and proactive in their cybersecurity measures to counteract the ongoing threats posed by RedEyes.