Security specialist company ESTsecurity (CEO Jung Jin-il) warned that hacking emails exploiting various social concerns and anxieties are being mass-distributed in South Korea, and that users need to pay special attention, as announced on the 7th.

The ESTsecurity Security Response Center (hereinafter referred to as ESRC) has confirmed that since March 25th, hacking emails with malicious Word (DOC) document files attached, such as 'COVID-19 quarantine rule violation investigation notification' and 'Emergency disaster relief fund application form', which trigger users' interest and anxiety, have been mass-distributed in Korea.

This attack has been identified as an extension of the attack revealed by ESRC on March 25th, which impersonated the 'Korea Internet & Security Agency (KISA)'. The email's attached Word files contained malicious macro commands commonly used in this type of analysis.

The attackers induce recipients to activate the malicious macro by pressing the [Enable Content] button. Once the button is pressed, the actual document screen is displayed while attempting to hide the threat exposure as much as possible. However, some attacks employ a simple deception strategy by showing broken phrases, making it appear as though the document content is damaged.

If the malicious macro is allowed, communication with the command and control (C2) server designated by the attacker takes place, and additional malicious files are installed without the user's knowledge. Moreover, information such as ▲ user names, ▲ types of antivirus programs, ▲ types of operating systems, ▲ system version information, etc., are covertly collected and attempted to be leaked.

The leaked primary information provides the necessary environment for staged follow-up attacks, so it is crucial to always pay special attention when checking emails, and not to allow the [Enable Content] button in Word or Excel documents for security reasons.

Currently, ESTsecurity's antivirus program ALYac is detecting these malicious codes as 'Trojan.Downloader.DOC.Gen', and the company is continuously responding to additional variants.

An ESRC official stated, "The techniques of hacking emails distributed by cyber threat organizations are becoming increasingly sophisticated and tricky," and "The unauthorized external leakage of unspecified numbers of PC information through hacking emails can be seen as a preliminary stage that may lead to unexpected additional harm," urging users to be vigilant.

Meanwhile, ESTsecurity is closely sharing related cyber threat information with authorities such as the Korea Internet & Security Agency (KISA) to prevent the spread of known threats.