dissecting-operation-troy.pdf (2 MB)

McAfee Labs links the March 20, 2013 Dark Seoul disruption to a longer Operation Troy espionage campaign against South Korean targets rather than a standalone wiping incident. The report says attackers likely gained remote access before the attack through spear-phished remote-access malware, then distributed a dropper that downloaded and executed MBR-wiping components across banks and news agencies. Evidence includes compile-time sequencing, Roman-themed strings such as “principes” and “hastati,” a “Make Troy” build path, and overlap between NewRomanic Cyber Army-themed wipers and material associated with the Whois Hacking Team defacement. Attribution remains unresolved in the excerpt, but the claimed groups are assessed as likely fabrications intended to misdirect investigators while the activity combined espionage access with destructive impact.