CSIS entry 74

CSIS Significant Cyber Incidents

North Korean hackers conducted an espionage campaign against South Korean entities to exfiltrate system reconnaissance data from potentially thousands of machines. The attackers used PowerShell scripts and Dropbox for command and control and data exfiltration, demonstrating improved operational security by the attackers.

The language used in the phishing lures strongly indicates that South Korea is the primary target of the DEEP#DRIVE campaign.

Given these patterns, we assess with high confidence that Kimsuky is the primary Advanced Persistent Threat (APT) group behind these attacks.