North Korean Hacker Group “Kimsuky” Operates New Spyware Suite

  • Kimsuky hackers are now deploying a modular spyware suite that can fetch a wide range of payloads.
  • The tool can perform reconnaissance, offer backdoor functionality, and engage in keylogging operations.
  • The targets of Kimsuky’s most recent campaigns include South Korea, Russia, the US, and various European countries.

The North Korean cyber-espionage group known as “Kimsuky” (aka “Thallium”) is using a new spyware suite, which is based on a modular approach. Called “KGH_SPY,” the tool can perform network reconnaissance, keylogging, information exfiltration, and backdoor functionality.

In addition to this tool, Kimsuky also appears to be using a new stealthy malware called “CSPY Downloader,” which can fetch various payloads from the group’s infrastructure without risking detection and analysis.

Source: Cybereason

This “refresh” was detected and analyzed by researchers of the Cybereason Nocturnus Team, who have found some code similarities to previously deployed malware from the same group, as well as partial infrastructure overlap. This is enough for assigning attribution with confidence, while the targets appear to be similar to what Kimsuky has always been focusing on.

Cybereason reports the following:

  • Pharmaceutical/Research companies working on COVID-19 vaccines and therapies
  • UN Security Council
  • South Korean Ministry of Unification
  • Various Human Rights Groups
  • South Korean Institute for Defense Analysis
  • Various Education and Academic Organizations
  • Various Think Tanks
  • Government Research Institutes
  • Journalists covering Korean Peninsula relations
  • South Korean Military

Several of the modules that were used with the KGH tool are spyware, and Kimsuky appears to be using a rich set. In many cases, the payloads set a reg key for persistence, collect system information, store it on a file and send it to the C2 server. The information that is targeted first has to do with the system, network, drives, and installed applications, so its reconnaissance.

None of the KGH modules that were tested by the researchers were detected by any AV vendors, so Kimsuky can fly undetected. This applies to spyware modules, backdoor tools, the keylogger functionality, and all secondary payloads fetched after the initial infection from the C2.

Source: Cybereason

As for how trouble starts, the infection vector that was observed involves two Word documents (0807.dotm and 0928.dotm) that come with malicious macro code. The file format is “DOTM,” a Word template that retains the settings defined by its creator, so the hackers can easily spawn new ones using fresh themes.

documents
Source: Cybereason
Source: Cybereason

Kimsuky has been around since 2012, and it is constantly updating its attack patterns and operational infrastructure. The fact that no anti-virus tool can detect any of the modules deployed in KGH_SPY is indicative of the sophistication that goes into their code obfuscation, anti-VM, and anti-debugging techniques. Cybereason gives a full list of IoCs, so target organizations can at least start from somewhere.

Latest
How to Watch Macy Murdoch Online: Stream the 2023 Spin-Off Series from Anywhere
Macy Murdoch is a new original tween mystery series, and we have the episode guide and release schedule, premiere date, cast, and...
Euro 2024 Qualifiers Live Stream: How to Watch International Soccer Online from Anywhere
The road to Euro 2024 is about to get underway, and Europe’s leading soccer stars will be battling it out to qualify...
How to Watch Redemption Online for Free: Stream the Paula Malcomson Series from Anywhere
Redemption is an upcoming British drama TV series featuring Paula Malcomson. You will find below all the information you may need, including...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari