EuRepoC
North Korean state-sponsored hacker group Kimsuky exploited vulnerabilities to gain access to ScreenConnect customer systems since at least 21 February 2024 · 21.02.2024
The North Korean state-sponsored hacker group Kimsuky gained access to ScreenConnect customer systems, the cyber risk advisory of Kroll reported on 5 March 2024. The operation is believed to have focused on long-term espionage and intelligence gathering. The threat actor exploited vulnerabilities in the ScreenConnect remote access software (CVE-2024-1708 and CVE-2024-1709), likely following their disclosure on 20 February, allowing for access to public-facing endpoints on which the vulnerable versions of the software were running. In the next step, the group distributed toddlershark, an iteration of Kimsuky's malware strain babyshark, designed for long-term information collection and maintaining persistent access to compromised systems. To access the ScreenConnect Endpoint, the group used a legitimate Microsoft binary to execute a malicious script while disguising its activities as a normal system process. According to South Korean Cyber News, toddlershark uses read-only technology to hide the code, modify system registries and bypass security systems. Through these capabilities, the malware seeks to enable long-term espionage by avoiding traditional digital-based detection methods and using randomly generated functions, variable names, and code positions.