Security firm McAfee has just released technical details of a massive malware attack which wiped tens of thousands of PCs in South Korea earlier this year.
McAfee's analysis very clearly points to military involvement inevitably linking this latest attack dubbed 'Operation Troy' with previous attacks such as 'Dark Seoul'.
Commonalities in the code base indicate that this is the latest in a continued series of assaults aimed at obtaining military secrets, gathering intelligence, and eventually disabling military computers.
The latest assault contains a MBR wiper component previously seen in 'Dark Seoul' and McAfee reports that the encryption routines for all these variants have been littered with Military keywords from 2009-2013.
The primary purpose of this series of malware is to steal data however extremely sophisticated capabilities are apparent with the MBR destruction routines only being triggered if the malware senses it is being analysed or debugged.
Capabilities also exist to scrape passwords, scan networks for document files, rate those systems according to what is found, and to drip feed details to the attacker's network via an encrypted HTTP connection which minimises suspicious network traffic.
For those of you that wish to read further, McAfee's full analysis of this malware and the full Operation Troy campaign is available here.
