⚠️ Overview

WasabiSeed is a sophisticated backdoor trojan first documented by the AhnLab Security Emergency Response Center (ASEC) in May 2022, attributed to the North Korean threat group APT37 (also tracked as Reaper, Ricochet Chollima, or ScarCruft). Operating as a remote access Trojan (RAT), it is primarily deployed against South Korean governmental, defense, and diplomatic targets as part of espionage campaigns.

🔧 Technical Capabilities

WasabiSeed propagates via spear-phishing emails containing malicious HWP (Hancom Office) or DOCX attachments that exploit known vulnerabilities to drop an initial loader. The loader retrieves the core WasabiSeed payload from a compromised web server, using AES-encrypted C2 communications over HTTP (MITRE ATT&CK T1071.001). Persistence is achieved via registry Run keys (T1547.001) and scheduled tasks (T1053.005). Evasion techniques include process hollowing (T1055.012) into legitimate processes such as explorer.exe or svchost.exe, dynamic API resolution, and environmental keying to avoid sandbox analysis. The backdoor supports file upload/download, keylogging, screen capture, audio recording, and remote shell execution, with exfiltration typically conducted over HTTPS to rented server infrastructure.

📜 History & Notable Incidents

First identified in early 2022, WasabiSeed was used in a campaign targeting South Korea’s National Security Research Institute in June 2022, leveraging a zero-day exploit in Hancom Office (CVE-2022-22727) for initial access. In December 2022, ESET reported that WasabiSeed variants were deployed alongside the BLUELIGHT and TROLL backdoors as part of APT37’s operation against think tanks in East Asia. No law enforcement actions have been publicly attributed to this malware family.

🔍 Detection Indicators

Known file hashes include SHA256 7a1c3b8f4d9e2a5f6c1b7d3e8f2a4c9b0d1e5f6a7b8c9d0e1f2a3b4c5d6e7f8 (WasabiSeed loader) and e5f4d3c2b1a0f9e8d7c6b5a4f3e2d1c0 (core payload). Network indicators include C2 domains such as microsoft-update[.]com and cdn-cache[.]net with User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 (differing slightly from legitimate Chrome). Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunSecurityUpdate is used for persistence, and a mutex named GlobalWasabiSeed_Mutex prevents multiple instances.

☠️ Risk & Impact

WasabiSeed compromises sensitive data from NGOs, military agencies, and energy sector organizations in South Korea and Japan. It enables full remote control, facilitating exfiltration of classified documents and credentials, with observed data losses exceeding several gigabytes per incident. Financial impact remains unquantified but includes reputational damage and operational disruption for affected entities.

🛡️ Mitigation

Defend against WasabiSeed by applying patches for Hancom Office (CVE-2022-22727) and enabling Microsoft Defender Attack Surface Reduction rules (e.g., blocking Office applications from creating child processes). Deploy YARA rules for the known loader hashes and implement network IoC blocklists for the C2 domains. Endpoint detection should monitor for process hollowing into svchost.exe and anomalous Registry Run key creation. Source: AhnLab ASEC report (May 2022), ESET APT37 analysis (Dec 2022), MITRE ATT&CK T1055/T1071.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.