29th May – Threat Intelligence Report · 2023-05-29
The North Korean APT group known as Kimsuky has launched a campaign targeting North Korea-focused information services, human rights activists, and organizations providing support to DPRK defectors. Kimsuky has made extensive use of less common TLDs during their malicious domain registration process, like abusing .space, .asia, .click, and .online TLD’s.
North Korea-focused information services, human rights activists, and DPRK-defector support organizations · 23/05/2023
Researchers from Sentinel Labs observe an ongoing campaign by the North Korean APT group Kimsuky targeting North Korea-focused information services, human rights activists, and DPRK-defector support organizations, using a variant of the RandomQuery malware, enabling subsequent precision attacks. [Date Occurred: 05/05/2023; Date Discovered: 05/05/2023]
‘RandomQuery’ malware phishing against DPRK-focused information services, human rights activists and defector support organizations · May 2023 (report)
Annex 65, Case 2: “A cybersecurity firm reported in May 2023 that Kimsuky was deploying a variant of the ‘RandomQuery’ malware via phishing emails sent to DPRK-focused information services, human rights activists, and defector support organizations. ... The data were eventually exfiltrated via the C2 server.”
Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit | SentinelOne · 2023-05-23T11:23:42.000Z
North Korean APT group focuses on file reconnaissance and information exfiltration with latest variant of RandomQuery malware.