North Korean APT Group Kimsuky targeted South Korean construction companies in supply chain attack in January 2024 · 01.01.2024
North Korean APT Group Kimsuky targeted South Korean construction companies in supply chain attack in January 2024, according to a joint report from the South Korean National Cyber Security Centre, the National Intelligence Service, and others.
According to intelligence agencies, the campaign is twofold: on the one hand, Kimsuky has been targeting the websites of construction agencies with malware hidden in authentication services when a user logs into the website. This allowed Kimsuky to infect the computers of local governments, public institutions, and other construction companies.
The joint campaign from Andariel started in April. The group exploited vulnerabilities in VPNs to install remote control malware into the systems of construction companies in South Korea. In this move, the hacker group is said to have succeeded in stealing machine and equipment-related blueprints.
The NCSC links the joint Kimsuky-Andariel campaign to North Korea's "Local Development 20x10 Policy," meant to facilitate the building of modern industrial facilities in the DPRK.
Sources cited by EuRepoC (6)
Show 1 more
Multiple organizations in South Korea · 07/02/2024
Researchers from S2W discover a Go language-based information-stealing malware distributed from a security program download page, dubbed Troll Stealer, attributed to the Kimsuky North Korean threat actor and targeting users in South Korea. [Date Occurred: Since at least 10/01/2024; Date Discovered: 10/01/2024]
Multiple organizations in South Korea · 23/02/2024
Researchers from AhnLab discover a new campaign carried out by the Korean Kimsuky distributing the TrollAgent malware disguised as security programs on a Korean construction-related association's website. [Date Occurred: -; Date Discovered: -]
TrollAgent That Infects Systems Upon Security Program Installation Process (Kimsuky Group) · 2024-02-16
excerpt: AhnLab SEcurity intelligence Center (ASEC) recently discovered that malware strains are downloaded into systems when users try to download security programs from a Korean construction-related association’s website. Login is required to use the website’s services, and various security programs must be installed to log in. Among the programs that must be installed for login, one […] | attribution sentence: The C&C branching commands of the backdoor malware strains used in these attacks are similar to the ones introduced in the following articles: “ AppleSeed Being Distributed to Nuclear Power Plant-Related Companies ” [1] uploaded in November 2022, and “ Kimsuky Targets South Korean Research Institutes with Fake Import Declaration ” [2] uploaded in November 2023. | target sentence: The C&C branching commands of the backdoor malware strains used in these attacks are similar to the ones introduced in the following articles: “ AppleSeed Being Distributed to Nuclear Power Plant-Related Companies ” [1] uploaded in November 2022, and “ Kimsuky Targets South Korean Research Institute
보안 프로그램 설치 과정에서 감염되는 TrollAgent (Kimsuky 그룹) · 2024-02-16
excerpt: ASEC(AhnLab SEcurity intelligence Center)에서는 최근 국내 건설 관련 협회의 홈페이지 상에서 보안 프로그램 설치 시도 시, 악성코드가 다운로드 되고 있다는 정황을 확인하였다. 해당 홈페이지에서 제공하는 서비스를 사용하기 위해서는 로그인이 필요하며 보안을 위해 다양한 보안 프로그램들을 설치해야 로그인을 진행할 수 있다. 로그인을 위해 설치하도록 유도되는 프로그램들 중 악성코드가 포함된 설치 프로그램이 존재하였으며 만약 사용자가 이를 다운로드해 […] | attribution sentence: 공격에 사용된 백도어 악성코드는 C&C 명령 분기문이 2022년 10월 공개된 “ 원자력 발전소 관련 기업 대상으로 AppleSeed 유포 ” [1] 포스팅 및 2023년 11월 공개된 “ 수입 신고서를 위장하여 국내 연구 기관을 노리는 Kimsuky ” [2] 포스팅에서 다룬 백도어 악성코드와 유사하다. | target sentence: 공격에 사용된 백도어 악성코드는 C&C 명령 분기문이 2022년 10월 공개된 “ 원자력 발전소 관련 기업 대상으로 AppleSeed 유포 ” [1] 포스팅 및 2023년 11월 공개된 “ 수입 신고서를 위장하여 국내 연구 기관을 노리는 Kimsuky ” [2] 포스팅에서 다룬 백도어 악성코드와 유사하다.
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer… · 2024-02-07
attribution sentence: (Attribution) Based on the Kimsuky group’s recent active use of Go-based malware, and the fact that Troll Stealer contains a lot of code similar to the AppleSeed and AlphaSeed malware associated with the Kimsuky group, we speculate that the Kimsuky group is behind the distribution of this malware. | target sentence: (Target) Troll Stealer includes the ability to steal the GPKI folder on infected systems, which suggests that the campaign may have been targeting devices within administrative and public organizations in South Korea.
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer… · 2024-02-07
attribution sentence: TrollStealer 악성코드에 존재하는 경로 S2W 위협 연구 및 인텔리전스 센터인 Talon은 해당 악성코드가 기존 AppleSeed 악성코드에서 시스템 정보를 수집하기 위한 명령어가 거의 동일한 부분과, AlphaSeed 악성코드가 사용하는 RC4 + RSA 조합을 동일하게 파일 암호화에 사용한다는 점과 같이 기존 Kimsuky 그룹의 악성코드와 유사점이 발견되어 해당 악성코드의 배후에 Kimsuky 그룹이 있을 것으로 추정하고 있다. | target sentence: Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (Korean ver.) Author : Jiho Kim & Sebin Lee | BLKSMTH Last Modified : Feb 7, 2024 Photo by Mark König on Unsplash Executive Summary 2024년 1월 10일, S2W의 위협 연구 및 인텔리전스 센터 Talon은 Kimsuky 그룹의 새로운 악성코드로 추정되는
TrollAgent malware via a ROK construction-sector industry association website · January 2024
(MSMT/2025/2, report p. 92) “In January 2024, Kimsuky distributed malware through the website of an industry association in the ROK’s construction sector. To initiate the cyber operation, Kimsuky embedded a malware dubbed “TrollAgent” to the security authentication software that was used to login to the website. Stolen valid digital certificates were used ... It is assessed that this operation was an attempt to launch a targeted cyber operation against ROK public officials in the construction sector”
Espionage Operation Disguised as Software Installers by Kimsuky (APT-Q-2) · 2024-03-05T16:57:20.000Z
Kimsuky, also known as Mystery Baby, Baby Coin, Smoke Screen, Black Banshe, etc., internally tracked as APT-Q-2 by QiAnXin. This APT organization was publicly disclosed in 2013, with its earliest attack activities dating back to 2012, suspected to have originated from Northeast Asia. Kimsuky primarily targets South Korea, involving sectors such as defense, education, energy, government, healthcare, and think tanks, focusing on stealing confidential information. The group typically employs social engineering, spear-phishing emails, watering hole attacks, and other methods to deliver malicious software, with a variety of attack techniques and weapons targeting both Windows and Android platforms.