Babyshark - US

ThaiCERT Threat Group Cards

The spear phishing emails were written to appear as though they were sent from a nuclear security expert who currently works as a consultant for in the U.S. The emails were sent using a public email address with the expert’s name and had a subject referencing North Korea’s nuclear issues. https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/

Dyadic Cyber Incident Dataset v2

North Korean operatives targeted research-oriented organisations including: Stanford University, Congressional Research Service (CRS), a United States-based think tank, and five different email service providers. No evidence that this incident was successful.

Dyadic Cyber Incident Dataset v2

North Korean operatives targeted a research-oriented organisation, the Royal United Services Institute. No evidence that this incident was successful.

Dyadic Cyber Incident Dataset v2

North Korean operatives targeted French government entities, no evidence to support the incident was sucessful

CFR Cyber Operations Tracker

A threat actor used the malware BabyShark, which uses infrastructure associated with North Korean campaigns. The malware was delivered in November 2018 via spear-phishing emails written to appear as though they were sent from a nuclear security expert who works as a consultant for the U.S. government. The subject of the emails referenced North Korea’s nuclear program.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Palo Alto Networks reveal the details of BabyShark, a cyber espionage campaign targeting national security think tanks and academic institutions in the US allegedly carried out by a hacking group working out of North Korea.

Palo Alto Networks Unit 42

In February 2019, Palo Alto Networks Unit 42 researchers identified spear phishing emails sent in November 2018 containing new malware that shares infrastructure with playbooks associated with North Korean campaigns. The emails had a malicious Excel macro document attached, which when executed led to a new Microsoft Visual Basic (VB) script-based malware family which we are dubbing “BabyShark”.

New BabyShark Malware Targets U.S. National Security Think Tanks

A university in the U.S. which was to hold a conference about North Korea denuclearization issue at the time

Unit 42 determined that hackers had targeted a U.S. university scheduled to discuss North Korea denuclearization at an upcoming conference, as well as a national security think tank based in the U.S.

The security firm AlientVault tied BabyShark to the Kimsuky campaign.