Cyber Incident Victim: Fractured Statue
Date:
Jul 2019
Location:
United States of America
Summary
A U.S. government agency and foreign nationals professionally linked to North Korean activities were targeted in a phishing campaign delivering malicious Microsoft Word attachments from Russian email addresses, distributing CARROTBALL and CARROTBAT malware droppers. These payloads deployed SYSCON, a remote access trojan using FTP for command-and-control communications, enabling persistent system access and data exfiltration. The campaign, attributed with moderate confidence to the KONNI threat group aligned with North Korean interests, featured evolving tactics including embedded binary payloads and architecture-specific command execution. Activity occurred across multiple waves, with CARROTBALL appearing in the final wave alongside decoy documents discussing North Korean geopolitical topics, demonstrating the group's continued refinement of delivery mechanisms while maintaining consistent operational objectives.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The Fractured Statue campaign occurred between July and October 2019, targeting a U.S. government agency and non-U.S. foreign nationals professionally affiliated with North Korean activities. Attackers sent phishing emails from four Russian email addresses containing six unique malicious Microsoft Word document lures. These documents, themed around North Korean geopolitical relations, delivered malware payloads when opened. Five documents utilized the CARROTBAT dropper, first observed in a 2017 attack against a British government agency, while one document in the final wave delivered a new malware family called CARROTBALL. Both droppers downloaded and installed SYSCON, a full-featured remote access trojan that communicated with command-and-control servers via FTP. The campaign unfolded in three distinct waves, with the final wave occurring in October 2019 using an email titled "The investment climate of North Korea" sent from the address "pryakhin20l0@mail[.]ru."
Initial waves employed a consistent macro technique that checked the victim's Windows architecture, executed commands hidden in document textboxes, then cleared forensic evidence by deleting textboxes and saving the file. The final wave introduced technical evolution with CARROTBALL's delivery mechanism, which embedded a Windows binary as hex bytes delimited by pipe characters within the macro. Upon execution, the macro converted these hex bytes into binary executable files on disk. Researchers from Palo Alto Networks' Unit 42 attributed the campaign with moderate confidence to the KONNI threat group, noting alignment with North Korean interests but acknowledging potential false-flag operations due to publicly available technical details about KONNI's tactics. The campaign demonstrated progression in tactics while maintaining core operational patterns observed in the group's November 2018 activities, particularly through the continued use of document-based initial access and SYSCON RAT deployment.