Operation MIDAS

## Overview

In this presentation, researchers Yunyang Kim and Suk Jang present an in-depth analysis of fraudulent fake stock trading systems targeting victims in South Korea. Spurred by the post-COVID-19 South Korean stock market boom, cybercriminals developed financial investment and pig-butchering scams modeled directly after "as-a-service" cybercrime ecosystems (such as Ransomware-as-a-Service or Malware-as-a-Service). In this operational hierarchy, software suppliers develop and maintain the fake trading software infrastructure, while independent criminal affiliates purchase the platform and execute fraudulent schemes against South Korean victims.

## Discovery and Operational Security (OPSEC) Failures

The investigation originated from social media monitoring when a malware analyst noted that infected host screenshots were publicly exposed via web directory listings. Closer inspection revealed management interfaces, group chat directions, and titles such as "General Manager," confirming that both victim devices and criminal operator systems were being exposed.

The researchers identified three primary OPSEC failures committed by the actors: 1. **Server Misconfigurations:** Web directory listings leaked screenshot feeds belonging to victims as well as internal operational panels used by the criminals. 2. **Dual-Use of Personal Devices:** Affiliate members used operational devices for daily activities. Screenshots captured an affiliate playing an online game requiring national identity verification under South Korea's age regulations, as well as leaking home addresses and personal information. 3. **Developer Environment Leaks:** Platform suppliers inadvertently exposed development credentials, communication channels, and internal environments. Leaked screenshots enabled researchers to trace the main developer's activity across TradingView, GitHub, and Android app stores.

## Data Collection and Analysis Methodologies

To systematically gather intelligence without disrupting active operations or alerting the threat actors, the researchers implemented a throttled collection framework: - **Rate-Limited Scraping:** To prevent server overload or detection from multi-threaded requests, researchers downloaded exposed data using strictly one thread per server. - **Triage of 12 Terabytes of Screenshots:** Facing 12 TB of image data, researchers filtered out standard victim screenshots by excluding assigned user IDs above 1,000. - **Template Matching:** Computer vision template matching was applied against the remaining screenshots to flag recurring operational software, specifically developer code editors and VPN clients.

## Infrastructure Tracking and Campaign Attribution

The investigation expanded into the suppliers' development and demonstration infrastructure, which had been set up to showcase the platform to prospective affiliates: - **Service & Port Profiling:** The demonstration environment exposed IIS web servers, FTP services, and RDP interfaces mapped to specific, non-standard port assignments. - **Passive DNS & IP Monitoring:** Using port assignment fingerprints combined with passive DNS (pDNS) history and IP address tracking (including web update logging), researchers mapped the infrastructure. This tracked affiliate transitions and exposed origin servers when actors failed to implement Cloudflare CDN protection. - **Code Signing and Domain Attribution:** Analysis of installer binaries revealed three distinct code-signing certificates. Although suppliers utilized privacy protection for domain registrations, operational oversights revealed that the same business entity named in the code-signing certificate was also used to register campaign domains. - **Hosting and Targeting Infrastructure:** Both suppliers and affiliates were identified as South Korea–based criminals targeting domestic users. To ensure low network latency, backend servers were hosted in data centers across South Korea and Japan, integrating local financial APIs.