Users in South Korea · 24/10/2022
Researchers from S2W discover a new campaign by the North Korean threat actor Kimsuky, using three different Android malware strains (FastFire, FastViewer, and FastSpy) to target users located in South Korea. [Date Occurred: -; Date Discovered: -]
Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware · 2022-10-24
attribution sentence: As a result of analyzing the APKs, we figured out that there is a significant association with the past campaigns attributed to Kimsuky group. | target sentence: Author : Sebin, Lee & Yeongjae, Shin | S2W TALON Last Modified : Oct 24, 2022 Photo by Afif Ramdhasuma on Unsplash Executive Summary S2W’s threat research and intelligence center, Talon, recently identified three new types of malware that target Android devices.
Fastfire, FastViewer and FastSpy · October
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 30 of 37). RGB Unit: Kimsuky; Case Name: Fastfire, FastViewer and FastSpy; SPH √; VAS: (blank); Publicized Month: October. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
Android malware ‘FastFire’, ‘FastViewer’ and ‘FastSpy’
Annex 79 (Other espionage-related activities of Kimsuky and Lazarus Group): “A cybersecurity company reported that Kimsuky has been using three different Android malware strains to target its victims. This malware was named as malware families ‘FastFire’, ‘FastViewer’, and ‘FastSpy’. ... Once launched the malwares enable the adversary to seize control of the targeted devices, intercept phone calls and SMS, track users' locations, harvest documents, capture keystrokes, and record information from the mobile's camera, microphone, and speaker.”