DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

North Korean state-sponsored hacking group Kimsuky targeted the staff of consulting firm Korea Risk Group (KRG) and other organizations in the United States, Europe and Asia since December 2022

Date (as written)
01.12.2022
Year
2022
Country
Korea, Republic of;Asia (region);Asia (region);Europe (region);Europe (region);United States;United States
Actors (as written)
Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094
Actor pages
KimsukyVelvet ChollimaSTOLEN PENCILEmerald Sleet fka THALLIUMBlack BansheeG0094
Tags (as written)
Hijacking without Misuse

Source entries (1)

EuRepoC

North Korean state-sponsored hacking group Kimsuky targeted the staff of consulting firm Korea Risk Group (KRG) and other organizations in the United States, Europe and Asia since December 2022 · 01.12.2022
The North Korean state-sponsored hacking group Kimsuky has targeted personnel at the consulting firm Korea Risk Group (KRG) and other organizations in the United States, Europe and Asia since December 2022, US-based IT security firm SentinelOne reported. The other organizations included governments, research universities, and think tanks. The North Korean hacking group used the ReconShark malware component, a newer variant of BabyShark. The goal of the operations was to identify organizations of interest for further compromise.
Sources cited by EuRepoC (22)
https://www.bleepingcomputer.com/news/security/kimsuky-hackers-use-new-recon-tool-to-find-security-gaps/
https://twitter.com/SentinelOne/status/1654125372571779080
https://www.sentinelone.com/labs/kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/
https://twitter.com/cyb3rops/status/1654229569384202243
https://twitter.com/TomHegel/status/1654153276521082882
Show 17 more
https://twitter.com/securityaffairs/status/1654896483110354944
https://thehackernews.com/2023/05/n-korean-kimsuky-hackers-using-new.html
https://twitter.com/securityaffairs/status/1654584114593316865
https://securityaffairs.com/145781/apt/kimsuky-reconshark-recon-tool.html
https://twitter.com/securityaffairs/status/1654468337215184896
https://twitter.com/DarkReading/status/1655592450432352257
https://twitter.com/Dinosn/status/1655580518681804802
https://www.darkreading.com/attacks-breaches/north-korean-apt-uses-malicious-microsoft-onedrive-links-to-drop-new-malware
https://twitter.com/DarkReading/status/1655716963216248835
https://twitter.com/securityaffairs/status/1655500836649291776
https://twitter.com/780thC/status/1661326518146985988
https://twitter.com/SentinelOne/status/1661427710252711936
https://www.govinfosecurity.com/north-korean-apt-group-kimsuky-shifting-attack-tactics-a-22159
https://socradar.io/may-2023-cyberwatch-recap-a-month-in-cybersecurity/
https://www.darkreading.com/edge/why-identity-management-key-stopping-apt-cyberattacks
https://www.bleepingcomputer.com/news/security/us-govt-sanctions-north-koreas-kimsuky-hacking-group/
https://cyberscoop.com/u-s-government-sanctions-prolific-north-korean-cyber-espionage-unit/

Suggest a correction on GitHub