# Targeted APT Activity: BABYSHARK Is Out for Blood

DPRK APT phished a nuclear think tank with a password-protected VOA-themed macro doc, achieving OneDrive DLL hijacking, Google Drive-hosted VBScript C2, and a RAT.

- Payout: Real-world hack
- Severity: high
- Program: Nuclear think tank
- Analysis by: Huntress
- Disclosed: 2022-03-01
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/targeted-apt-activity-babyshark-is-out-for-blood
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-targeted-apt-activity-babyshark-is-out-for-blood
- Tags: area:os domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:default-creds technique:source-review vuln:dependency-confusion

**Target:** Windows endpoints; Microsoft Word macros, OneDrive, Google Drive, scheduled tasks, registry
**Root cause:** Password-protected macro document delivered via a spoofed VOA author email disabled Word macro protections and dropped version.dll beside OneDrive.exe for DLL hijacking; VBScript stagers pulled obfuscated payloads from Google Drive/OneDrive and C2 domains.
**Steps:**
1. Victim receives email from fake VOA author; replies; attacker returns OneDrive link to `VOA_Korea.zip` with password `voa2021`
2. Macro checks OneDrive presence, downloads decoy `http[:]//beastmodser.club/sil/0304/VOA_Korea[.]docx`, exits if BitDefender/Norton present
3. Macro disables Word macro security registry keys, downloads `https[:]//beastmodser.club/sil/0304/d[.]php?na=version.gif` as version.tmp, renames to version.dll in OneDrive dir, starts OneDriveStandaloneUpdater.exe
4. Scheduled task `GoogleUpdater` runs `qwert.vbs`, which downloads a Google Drive page and carves data between `johnbegin`/`johnend` into `normal.crp`
5. Second execution deobfuscates normal.crp; checks username is `Administrator` or `Bob`, else beacons to HTTP C2 and exits
6. For Bob: adds registry persistence under `HKEY_CURRENT_USER\Software\RegisteredApplications\[random]`, stages sys0.vbs/sys1.vbs scheduled tasks (29/61 min)
7. Beacon to `worldinfocontact[.]club/111/alex/expres[.]php?op=2` retrieves commands; fallback relaunches OneDrive; hodbeast.com returns enumeration commands piped to ttmp1.log, base64 via `certutil -f -encode`, POSTed to `https[:]//hodbeast.com/silver/upload[.]php`
8. desktop.r5u/desktop.xml certutil-decode to base64 PE DLL (pdb `rat_load.pdb`), likely KimJongRAT variant
**How found:** Started from persistence detection (scheduled task GoogleUpdater running qwert.vbs), pulled the Google Drive page with curl, noticed odd `johnbegin`/`johnend` delimiters in the filename, matched to public BABYSHARK research, then deobfuscated normal.crp and pivoted across hosts; AV scan logs across three hosts revealed VOA_Korea.zip, cracked password `voa2021` with hashcat/John, and olevba exposed the macro.
**Exploitation:** Spear-phish built trust as a VOA author, sent password-protected macro doc that bypassed AV scanning, disabled macro warnings, dropped version.dll for OneDrive DLL hijack, then used scheduled VBScript tasks and Google Drive/OneDrive-hosted obfuscated payloads for C2 beaconing, host enumeration, exfiltration via certutil-encoded POST, and RAT deployment; dwell time ~1 year.
**Escalation:** Initial macro on Alex led to forwarding to Bob/Charlie; username-gated payload targeted Bob specifically, adding registry persistence, multiple C2 channels, and a RAT for long-term espionage.
**Insight:** Obfuscated payloads hidden in the filename/HTML of a benign cloud page (Google Drive) with custom delimiters evade network detection; also, AV scan logs showing a failed ZIP scan are a strong signal of password-protected malicious archives worth retrieving and cracking.

## Proof of concept (copied exactly from the original report)

**Malicious macro downloads fake doc and version.dll**

```
Checks for the presence of OneDrive
 
- Downloads a new Microsoft Word document to show the user and convince them of the phish: (http[:]//beastmodser.club/sil/0304/VOA_Korea[.]docx)
 
- Checks for the presence of antivirus products like BitDefender or Norton Security, and quits if present
 
- Disables Microsoft Word macro protections in registry
 
- 
 Downloads a version.tmp file to be then moved and renamed as version.dll for the OneDrive DLL hijacking attack (https[:]//beastmodser.club/sil/0304/d[.]php?na=version.gif)

- Starts OneDriveStandaloneUpdater.exe to begin the DLL hijacking attack
```

**r.vbs OneDrive DLL hijack removal script**

```
On Error Resume Next
Set wShell=CreateObject("WScript.Shell")
retu=wShell.run("cmd.exe /c taskkill /im onedrive.exe /f & timeout 3& del
 ""%userprofile%\AppData\Local\Microsoft\OneDrive\version.dll""",0,true)
retu=wShell.run("cmd.exe /c timeout 5",0,true)
retu=wShell.run("""%userprofile%\AppData\Local\Microsoft\OneDrive\onedrive.exe""
 /background",0,false)
```

**desktop.tmp OneDrive relaunch fallback command**

```
On Error Resume Next:Set wShell=CreateObject("WScript.Shell"):retu=wShell.run("""%userprofile%\AppData\Local\Microsoft\OneDrive\onedrive.exe"" /background",0,false)
```