Kimsuky Group Using Meterpreter to Attack Web Servers

ThaiCERT Threat Group Cards

Kimsuky Group Using Meterpreter to Attack Web Servers https://asec.ahnlab.com/en/53046/

AhnLab ASEC blog (asec.ahnlab.com)

excerpt: AhnLab Security Emergency response Center (ASEC) has recently discovered the distribution of malware targeting web servers by Kimsuky group. Kimsuky is a threat group deemed supported by North Korea and has been active since 2013. At first, they attacked North Korea-related research institutes in South Korea before attacking a Korean energy corporation in 2014. Since […] | attribution sentence: AhnLab Security Emergency response Center (ASEC) has recently discovered the distribution of malware targeting web servers by Kimsuky group. | target sentence: AhnLab Security Emergency response Center (ASEC) has recently discovered the distribution of malware targeting web servers by Kimsuky group.

AhnLab ASEC blog (asec.ahnlab.com)

excerpt: AhnLab Security Emergency response Center(ASEC)에서는 최근 Kimsuky (김수키) 공격 그룹이 웹 서버를 대상으로 악성코드를 유포하고 있는 것을 확인하였다. Kimsuky는 북한의 지원을 받고 있다고 확인되는 위협 그룹으로 2013년부터 활동하고 있다. 초기에는 한국의 북한 관련 연구기관 등에 대한 공격을 진행했으며 2014년 한국의 에너지 기관에 대한 공격을 진행했으며 2017년 이후 한국 외 다른 나라에 대한 공격도 진행하고 있다. […] | attribution sentence: AhnLab Security Emergency response Center(ASEC)에서는 최근 Kimsuky (김수키) 공격 그룹이 웹 서버를 대상으로 악성코드를 유포하고 있는 것을 확인하였다. | target sentence: AhnLab Security Emergency response Center(ASEC)에서는 최근 Kimsuky (김수키) 공격 그룹이 웹 서버를 대상으로 악성코드를 유포하고 있는 것을 확인하였다.

UN Panel of Experts S/2024/215

Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 18 of 75, PDF p. 322). DPRK cyber actor: Kimsuky; Report Name: Kimsuky Group Using Meterpreter to Attack Web Servers; Case Summary: Kimsuky attacked a Windows IIS web server of a Republic of Korea construction company and executed a Powershell command that downloaded a malicious backdoor “img.dat” file, also known as Metasploit Meterpreter.; Publication Month: May

UN Panel of Experts S/2023/656

Para 109: “A cybersecurity company reported in March that Kimsuky had attacked an Internet Information Services web server of a construction company with vulnerabilities because patches were not updated. The breach installed a Meterpreter malware in the target systems to allow Kimsuky to gain control of the web server.”

UN Panel of Experts S/2023/656

Annex 64 (Links to Ahnlab Security Emergency Response Center (ASEC) reports in 2023 (as of July 2023); Source: ASEC), listed under “Kimsuky Group”: “Kimsuky Group Using Meterpreter to Attack Web Servers” (22 May 2023)

The attack target was a Windows IIS web server of a Korean construction company