VBS Script Disguised as PDF File Being Distributed (Kimsuky) · 2022-03-23
excerpt: On March 23rd, the ASEC analysis team has discovered APT attacks launched by an attack group presumed to be Kimsuky, and they targeted certain Korean companies. Upon running the script file with the VBS extension, the malware runs the innocuous PDF file that exists internally to trick the user into thinking that they opened an […] | attribution sentence: On March 23rd, the ASEC analysis team has discovered APT attacks launched by an attack group presumed to be Kimsuky, and they targeted certain Korean companies. | target sentence: On March 23rd, the ASEC analysis team has discovered APT attacks launched by an attack group presumed to be Kimsuky, and they targeted certain Korean companies.
PDF 문서로 위장하여 유포되는 VBS 스크립트 (Kimsuky) · 2022-03-23
excerpt: ASEC 분석팀은 금일(03/23) Kimsuky 조직으로 추정되는 공격 그룹이 국내 특정 기업을 대상으로 APT 공격을 수행하고 있음을 확인하였다. VBS 확장자의 스크립트 파일을 실행 시, 내부에 존재하는 정상 PDF 파일을 실행하여 마치 정상 문서를 열람한 것처럼 속이고, 악성 DLL 파일을 통해 정보유출 기능을 수행하게 된다. 공격 대상은 PDF 문서 내용을 볼 때, 정밀 가공 전문기업으로 추정되며, PDF […] | attribution sentence: ASEC 분석팀은 금일(03/23) Kimsuky 조직으로 추정되는 공격 그룹이 국내 특정 기업을 대상으로 APT 공격을 수행하고 있음을 확인하였다. | target sentence: ASEC 분석팀은 금일(03/23) Kimsuky 조직으로 추정되는 공격 그룹이 국내 특정 기업을 대상으로 APT 공격을 수행하고 있음을 확인하였다.
APT attacks using VBS Script disguised as PDF · March
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 5 of 37). RGB Unit: Kimsuky; Case Name: APT attacks using VBS Script disguised as PDF; SPH √; VAS: (blank); Publicized Month: March. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
VBS Script Disguised as PDF File Being Distributed (Kimsuky) · 28 March 2022
Annex 53.2 (Links to reports from Ahnlabs ASEC in 2022; Source: Ahnlabs ASEC, annotated by the Panel), listed under “Kimsuky Group”: “VBS Script Disguised as PDF File Being Distributed (Kimsuky)” (28 March 2022)