larva-26005

Executive Summary

Larva-26005 is a North‑Korean threat actor that has been active since at least 2020, primarily targeting Korean corporate and governmental organizations. The group uses spear‑phishing LNK attachments, DLL side‑loading, and script‑based droppers to deploy the Xctdoor backdoor and earlier CRAT malware, which provide full remote access, credential theft, and cryptomining capabilities on Microsoft SQL Server installations. Recent campaigns extend beyond South Korea to include South China Sea allies (DE, BR), exploiting compromised email/cloud accounts for initial access and leveraging popular web services as covert command‑and‑control channels.

Goals & Targeting

Larva-26005 primarily aims to acquire political and economic leverage through espionage, disruption, and destructive capabilities. The actor targets defense, government, media, financial services, non-profit, and IT sectors across South Korea, North Korea, Germany, and Brazil, with a clear focus on institutions that provide strategic intelligence, technological data, or financial assets. Their approach combines targeted phishing with social engineering, leveraging compromised email accounts to reach high‑value users, and exploiting publicly available cloud resources for both C2 communications and exfiltration, thereby maximizing operational security while broadening the adversary’s attack surface.

Key Capabilities

• Bypasses User Account Control (UAC) for privilege escalation
• Compromises email and cloud accounts for initial access and credential theft
• Uses common web services (Google, GitHub, Twitter, Dropbox, OneDrive, AWS) as covert command‑and‑control channels
• Deploys cryptomining malware on Microsoft SQL Server installations
• Establishes VPN services to facilitate remote lateral movement
• Targets and exploits MS‑SQL databases for persistence and mining
• Performs DLL side‑loading and script‑based dropping of payloads
• Captures screenshots, keylogs, and audio for data theft
• Exfiltrates data via cloud storage solutions

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The known operations of Larva‑26005 exhibit a consistent operational cadence, typically launching between late 2020 and early 2023. Their campaigns leverage spear‑phishing LNKs, DLL side‑loading, and script-based droppers to infect target networks. Victim types range from defense contractors and government ministries in South Korea to media outlets, financial firms, non-profits, and IT service providers in Germany and Brazil. A notable past operation includes a high‑profile intrusion into several Korean financial institutions where the actor deployed Xctdoor alongside CRAT modules, extracted credentials, and exfiltrated data to encrypted Dropbox drives. The actor’s patterns also suggest cross‑regional activity linking operations in North Korea with those in neighboring regions through common cloud infrastructure utilization.

IOC Patterns

• Use of legitimate web services for command‑and‑control
• Exfiltration via cloud storage (Dropbox, OneDrive, AWS S3)
• Compromise and reuse of email accounts for phishing campaigns
• Bypassing UAC mechanisms for privilege escalation

Recommended Actions

• Implement privileged access management and monitor for UAC bypass attempts
• Detect outbound traffic to popular web service APIs used for C2 and exfiltration
• Deploy monitoring for anomalous usage or compromise of corporate cloud and email accounts
• Enforce least‑privilege principles on local account creation and usage
• Apply security patches for Microsoft SQL Server promptly
• Monitor logs for anomalous VPN connections and remote access attempts
• Deploy detection rules to flag cryptomining activity on servers
• Isolate affected servers from the network until remediation is complete

Suggested Tags