Organizations in South Korea · 08/02/2022
Researchers from AhnLab discover a new wave of activity from the Kimsuky hacking group, involving the commodity open-source remote access tool xRAT dropped with their custom backdoor, Gold Dragon. [Date Occurred: 24/01/2022; Date Discovered: 26/02/2022]
Distribution of Kimsuky Group’s xRAT (Quasar RAT) Confirmed · 2022-01-28
excerpt: On January 26th, 2022, the ASEC analysis team has discovered that the Kimsuky group was using the xRAT (Quasar RAT-based open-source RAT) malware. xRAT Github Address: https://github.com/tidusjar/xRAT According to the logs collected by AhnLab’s ASD (AhnLab Smart Defense) infrastructure, the attacker installed a variant of Gold Dragon on the first infected PC on January 24th. […] | attribution sentence: On January 26th, 2022, the ASEC analysis team has discovered that the Kimsuky group was using the xRAT (Quasar RAT-based open-source RAT) malware. | target sentence: xRAT malware The attacker was also meticulous enough to also distribute an additional file (UnInstall_kr5829.co.in.exe) along with xRAT to delete the traces of attack existing in the target PC.
Kimsuky 그룹의 xRAT(Quasar RAT) 유포 정황 · 2022-01-28
excerpt: 2022년 1월 26일 ASEC 분석팀은 Kimsuky 공격 그룹에서 xRAT (Quasar RAT 기반의 오픈소스 RAT) 악성코드를 사용하는 정황을 포착하였다. xRAT Github 주소 : https://github.com/tidusjar/xRAT 자사 ASD(AhnLab Smart Defense) 인프라에 확보된 로그에 따르면 공격자는 Gold Dragon의 변종을 1월 24일 최초 감염 PC에 설치하였다. 확보된 파일이 Gold Dragon의 변종이라고 추정하는 근거는 다음과 같다. 기존 Gold Dragon이 사용하는 인젝션 […] | attribution sentence: 2022년 1월 26일 ASEC 분석팀은 Kimsuky 공격 그룹에서 xRAT (Quasar RAT 기반의 오픈소스 RAT) 악성코드를 사용하는 정황을 포착하였다. | target sentence: [그림 2] xRAT 악성코드 이외에도 공격자는 xRAT 유포와 함께 타겟 PC에 존재하는 기존에 공격한 흔적을 제거하기 위한 추가 파일(UnInstall_kr5829.co.in.exe)을 유포하는 치밀함이 확인되었다.
Distribution of xRAT · February
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 3 of 37). RGB Unit: Kimsuky; Case Name: Distribution of xRAT; SPH √; KAC √; VAS: (blank); Publicized Month: February. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
Kimsuky xRAT (Quasar RAT) and disguised Word and PDF spearphishing
Para 124: “A cybersecurity firm reported that the Kimsuky Group has been using remote action trojan “xRAT (Quasar RAT-based open-source RAT)” malware and other disguised Word and PDF files to spearphish victims.”
Distribution of Kimsuky Group’s xRAT (Quasar RAT) Confirmed · 8 February 2022
Annex 53.2 (Links to reports from Ahnlabs ASEC in 2022; Source: Ahnlabs ASEC, annotated by the Panel), listed under “Kimsuky Group”: “Distribution of Kimsuky Group’s xRAT (Quasar RAT) Confirmed” (8 February 2022)