Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide

McAfee Advanced Threat Research uncovered "Operation GhostSecret," a global data-reconnaissance campaign attributed with high confidence to Hidden Cobra (North Korean APT). The actors used multiple implants — including a Destover-like backdoor, a Bankshot-like variant, and an undocumented SSL listener Proxysvc — leveraging FakeTLS/PolarSSL and control servers (e.g., 203.131.222.83 hosted at Thammasat University) to collect and exfiltrate data from critical infrastructure, finance, healthcare, telecom, and other sectors; the report includes technical analysis, PE rich-header correlations, command/telemetry behavior, IPs and file hashes as indicators of compromise.