North Korean State-Sponsored Hacking Group Kimsuky Infiltrated South Korean Research Institutes to Steal Information for an Undisclosed Period of Time · 01.01.2023
The North Korean threat actor known as Kimsuky has been conducting a targeted spear-phishing campaign against research institutes in South Korea. The primary objective of this campaign has been to infiltrate systems and implant backdoors for the purpose of maintaining access and setting up data exfiltration channels.
Kimsuky Targets South Korean Research Institutes with Fake Import Declaration · 2023-11
Kimsuky Targets South Korean Research Institutes with Fake Import Declaration
https://asec.ahnlab.com/en/59387/
Targeting of South Korean research institutes · Nov 2023
North Korean threat actor Kimsuky targeted South Korean research institutes with a malicious import declaration. Opening the document would give Kimsuky access to the victim’s network.
Research institutes in South Korea · 30/11/2023
Researchers from AhnLab discover a new campaign by the North Korean threat actor Kimsuky, targeting research institutes in South Korea. [Date Occurred: 'Recently'; Date Discovered: 'Recently']
Kimsuky Targets South Korean Research Institutes with Fake Import Declaration · 2023-11-21
excerpt: AhnLab Security Emergency response Center (ASEC) has recently identified that the Kimsuky threat group is distributing a malicious JSE file disguised as an import declaration to research institutes in South Korea. The threat actor ultimately uses a backdoor to steal information and execute commands. The file name of the dropper disguised as an import declaration […] | attribution sentence: AhnLab Security Emergency response Center (ASEC) has recently identified that the Kimsuky threat group is distributing a malicious JSE file disguised as an import declaration to research institutes in South Korea. | target sentence: This file contains the attack target’s information.
수입 신고서를 위장하여 국내 연구 기관을 노리는 Kimsuky · 2023-11-21
excerpt: AhnLab Security Emergency response Center(ASEC)은 최근 Kimsuky 공격 그룹에 의해 수입 신고서를 위장한 악성 JSE 파일이 국내 연구 기관을 대상으로 유포되고 있음을 확인하였다. 공격자는 최종적으로 백도어를 활용하여 정보 탈취 및 명령을 수행한다. 수입 신고서를 위장한 드롭퍼 파일명은 아래와 같다. 수입신고서_날인.jse 파일 내부에는 난독화 된 파워쉘 스크립트, Base64 인코딩된 백도어 파일 및 정상 PDF가 존재한다. 파워쉘 […] | attribution sentence: AhnLab Security Emergency response Center(ASEC)은 최근 Kimsuky 공격 그룹에 의해 수입 신고서를 위장한 악성 JSE 파일이 국내 연구 기관을 대상으로 유포되고 있음을 확인하였다. | target sentence: AhnLab Security Emergency response Center(ASEC)은 최근 Kimsuky 공격 그룹에 의해 수입 신고서를 위장한 악성 JSE 파일이 국내 연구 기관을 대상으로 유포되고 있음을 확인하였다.