Hackers use Windows RID hijacking to create hidden admin account

A North Korean threat group has been using a technique called RID hijacking that tricks Windows into treating a low-privileged account as one with administrator permissions. The hackers used a custom malicious file and an open source tool for the hijacking attack. Both utilities can perform the attack but researchers at South Korean cybersecurity company AhnLab say that there are differences. The Relative Identifier (RID) in Windows is part of the Security Identifier (SID), a unique tag assigned to every user account to distinguish between them. RID can take values that indicate the account’s level of access, such as “500” for administrators, “501” for guest accounts, “1000” for regular users, and “512” for the domain admins group. RID hijacking occurs when attackers modify the RID of a low-privilege account to match the value of an administrator account, and Windows will grant it elevated access. However, performing the attack requires access to the SAM registry, so the hackers need to first breach the system and gain SYSTEM access. ASEC researchers, AhnLab's security intelligence center, attribute the attack to Andariel threat group, which has been linked to North Korea's Lazarus hacker group. The attacks begin with Andariel having SYSTEM access on the target via the exploitation of a vulnerability. The hackers achieve the initial escalation by using tools such as PsExec and JuicyPotato to launch a SYSTEM-level command prompt. Although SYSTEM access is the highest level on...