30th September – Threat Intelligence Report · 2024-09-30
Researchers identified two previously undocumented malware samples tied to the North Korean APT group Kimsuky, also known as Sparkling Pisces. The first, KLogEXE, is a keylogger that collects and exfiltrates user activity, while the second, FPSpy, is an advanced backdoor capable of data collection and command execution. Both samples share a codebase, suggesting a link between the two.
Multiple organizations in South Korea · 26/09/2024
Researchers from Palo Alto Networks observe the Kimsuky threat actors with ties to North Korea leveraging two new malware strains dubbed KLogEXE and FPSpy. [Date Occurred: Since at least 2022; Date Discovered: During 2022]
Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy · 2024-09-26T03:00:51
We analyze new tools DPRK-linked APT Sparkling Pisces (aka Kimsuky) used in cyberespionage campaigns: KLogExe (a keylogger) and FPSpy (a backdoor variant).
Sparkling Pisces (Kimsuky) KLogEXE keylogger and FPSpy backdoor · Q3 2024 (from title: APT QUARTERLY HIGHLIGHTS - Q3 2024)
The evolving cyber espionage landscape in Q3 2024 reveals the continuous evolution and sophistication of the North Korean APT group Sparkling Pisces (Kimsuky). Recent findings uncovered two undocumented malware samples: KLogEXE, a keylogger, and FPSpy, a variant of a backdoor used by the Sparkling Pisces.