AhnLab ASEC blog (asec.ahnlab.com)
Malicious HWP Files with BAT Scripts Being Distributed Actively (North Korea/National Defense/Broadcasting) · 2022-06-10
excerpt: The ASEC analysis team has discovered the active distribution of APT files that are exploiting a feature of HWP files (OLE object insertion) recently. After the case introduced in the post “Malicious HWP File Disguised as Press Release of 20th Presidential Election Early Voting for Sailors Being Distributed” on March 8th, the attacker is continuously […] | attribution sentence: [File Detection] Infostealer/PS.Kimsuky MD5 1d413a7c62b48760838bed0d03a35b05 390a2439581b8c04adace93fed2e4425 393f78e609af5e77da5ea9ba10facbfb 404e2fe1fbca70603cb91932664bc112 546ae7bd8b88289a21ac8d7dc62a3bd7 Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP . | target sentence: After the case introduced in the post “Malicious HWP File Disguised as Press Release of 20th Presidential Election Early Voting for Sailors Being Distributed” on March 8th, the attacker is continuously distributing malicious HWP files targeting people in the field of national defense, North Korea-re