Operation Sharpshooter — APT Profile

Operation Sharpshooter is the name McAfee's Advanced Threat Research team gave to a cyber-espionage campaign it disclosed in December 2018, having found the malware at 87 organizations, predominantly in the United States, across the nuclear, defense, energy and financial sectors during October and November of that year. Targets were approached with documents posing as job-recruitment material; a malicious macro injected a downloader into the memory of Word, which then pulled down a modular second-stage backdoor McAfee named Rising Sun that was capable of reconnaissance on the victim host. Rising Sun reuses source code from Duuzer, a 2015 backdoor tied to the North Korea-linked Lazarus Group, yet McAfee withheld attribution at the time, judging the technical links too obvious to take at face value and warning that they could be false flags. A follow-up published in March 2019, built on code and data from a command-and-control server that a government entity handed to the company, showed the operation had begun as early as September 2017, was still running, and shared striking similarities with attacks the industry ascribes to Lazarus — enough for McAfee to assess that it was likely the work of North Korean hackers. That later activity concentrated on financial services, government and critical infrastructure in Germany, Turkey, the United Kingdom and the United States.

Tools & malware

win.rising_sun Backdoor

Vendor research

Operation Sharpshooter: Campaign Targets Global Defense, Critical Infrastructure McAfee Advanced Threat Research (now hosted by Trellix)
'Operation Sharpshooter' Targets Global Defense, Critical Infrastructure McAfee Advanced Threat Research

Read the full analysis on IntelFusions