Kimsuky deploys TRANSLATEXT to target South Korean academia · 2024-03
Kimsuky deploys TRANSLATEXT to target South Korean academia
https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia
Targeting of Google Chrome users in the United States, South Korea, and Europe, particularly those involved in research into North Korean affairs · Jun 2024
Zscaler observed Kimsuky leveraging a malicious version of a Google Chrome extension, which Zscaler named “Translatext,” to steal information. The extension allows Kimsuky to bypass popular email servers’ security measures and access users’ inboxes.
South Korean academia, specifically those focused on North Korean political affairs · 27/06/2024
Researchers from Zscaler reveal that the North Korea-linked threat actor known as Kimsuky has been linked to the use of a new malicious Google Chrome extension, dubbed TRANSLATEXT, that's designed to steal sensitive information as part of an ongoing intelligence collection effort. [Date Occurred: Since at least early March 2024; Date Discovered: Early March 2024]
북한 해커 그룹 김수키, 새로운 악성 크롬 확장 프로그램 사용해 해킹 활동 전개 · 2024-06-30
attribution sentence(s): 북한의 사이버 해킹 그룹 김수키(Kimsuky)가 민감한 정보를 탈취하기 위해 새로운 악성 구글 크롬 (Google Chrome) 확장 프로그램을 사용하고 있는 것으로 밝혀졌다. | 이 확장 프로그램은 주로 북한 정치 문제를 연구하는 남한 학계를 대상으로 한 정보 수집 활동의 일환으로 사용되고 있다. | 김수키의 이번 캠페인은 한국 군사 역사에 대한 정보를 포함한 ZIP 파일로 시작된다.
Kimsuky Deploys TRANSLATEXT Chrome Extension |ThreatLabz · 2024-06-27
ThreatLabz observed Kimsuky targeting South Korean entities with TRANSLATEXT to steal email addresses, passwords, cookies, and capturing browser activity.
Kimsuky TRANSLATEXT Chrome extension · Q2 2024 (from title: APT Quarterly Highlights : Q2 2024)
Meanwhile, in Q2 2024, researchers discovered new activity from Kimsuky, involving the use of a malicious Google Chrome extension named “TRANSLATEXT” for cyber espionage. ... The attack primarily targeted South Korean academics involved in political research related to North Korea.