6月25日と7月1日に発生した韓国へのサイバー攻撃をまとめてみた

2013-06-26 piyokango A summary of the cyber attacks on South Korea that occurred on June 25th and July 1st.

http://d.hatena.ne.jp/Kango/20130626/1372257887

Thumbnail for 6月25日と7月1日に発生した韓国へのサイバー攻撃をまとめてみた

The excerpt describes a June 2013 incident wave in South Korea that disrupted government, political, military, and media sites, including outages, defacements, and publication of personal data allegedly taken from government-related systems. It reports that 16 organizations were affected, 131 servers went down, and several websites were defaced with Anonymous or High Anonymous-themed messages, while South Korean authorities raised the cyber crisis alert level and began a joint investigation. Technical details include a compromised SimDisk update mechanism, malware delivered from legitimate infrastructure, C&C-directed activity against target sites, Themida packing, password changes to "highanon2013," desktop image changes, destructive wiping behavior stronger than the earlier March 20 wiper, and Tor-based component retrieval. The excerpt lists infrastructure such as simdisk.co.kr, habang.co.kr, webmail.genesyshost.com, and 211.196.153.24, plus multiple hashes, but it presents attribution around Anonymous, High Anonymous, and OpNorthKorea as contested or suspected rather than conclusive.

Indicators of Compromise

Type Value First Seen Last Seen
DOMAIN webmail.genesyshost.com 2013-06-26 2013-07-09
HASH 219a3eb47dd165bc2eb73c71a17fddd… 2013-06-26 2013-06-26
HASH 6452133d10f0ac5cdeea84a170765a2… 2013-06-26 2013-06-26
HASH 00892dd0998bcf2ae29f1eb97a96554… 2013-06-26 2013-06-26
HASH 2996a2868615d65682e1ec30b1dceb0… 2013-06-26 2013-06-26
HASH 846ee1421267626593b32b83b6316e2… 2013-06-26 2013-06-26
HASH dfda04b5eb1a725b9a8371ef8615f6c… 2013-06-26 2013-06-26
HASH 8caa02c888cb071fbe0be3bcb4d25ab… 2013-06-26 2013-06-26
HASH 649c42a67a5d78efd99431803acfd1b… 2013-06-26 2013-06-26
URL http://www.edream.ac.kr 2013-06-26 2013-06-26
URL http://www.sekwang.co.kr 2013-06-26 2013-06-26
URL http://www.jungbo.net 2013-06-26 2013-06-26
URL http://www.dsimall.com 2013-06-26 2013-06-26
URL http://www.cakecall.com 2013-06-26 2013-06-26
URL http://www.yeongnam.com 2013-06-26 2013-06-26
URL http://www.nw119.com 2013-06-26 2013-06-26
URL http://www.cybertokdo.com 2013-06-26 2013-06-26
URL http://www.scco.co.kr 2013-06-26 2013-06-26
URL http://www.youngheungdo.com 2013-06-26 2013-06-26
URL http://www.gnnews.co.kr 2013-06-26 2013-06-26
IPv4 211.196.153.24 2013-06-26 2013-06-26

Related Reports

« Back