AppleSeed Disguised as Purchase Order and Request Form Being Distributed · 2022-06-30
excerpt: The ASEC analysis team has recently discovered the distribution of AppleSeed disguised as purchase orders and request forms. AppleSeed is a backdoor malware mainly used by the Kimsuky group. It stays in the system and performs malicious behaviors by receiving commands from attackers. Analysis Report on Kimsuky Group’s APT Attacks (AppleSeed, PebbleDash) The malware is […] | attribution sentence: AppleSeed is a backdoor malware mainly used by the Kimsuky group. | target sentence: As the files mentioned above mainly target certain companies, users should refrain from running attachments in emails sent from unknown sources.
발주서, 품의서를 위장한 AppleSeed 유포 · 2022-06-30
excerpt: ASEC 분석팀은 최근들어 발주서, 품의서를 위장하여 AppleSeed 악성코드를 유포하는 정황을 포착하였다. AppleSeed는 Kimsuky 조직에서 주로 사용되는 백도어성 악성코드로 시스템에 상주하면서 공격자의 명령을 받아 악성행위를 수행한다. Kimsuky 그룹의 APT 공격 분석 보고서 (AppleSeed, PebbleDash) – ASEC BLOG 본 문서는 최근 Kimsuky 그룹에서 사용하는 악성코드들에 대한 분석 보고서이다. Kimsuky 그룹은 주로 스피어피싱과 같은 사회공학적 공격 방식을 이용하는데, […] | attribution sentence: AppleSeed는 Kimsuky 조직에서 주로 사용되는 백도어성 악성코드로 시스템에 상주하면서 공격자의 명령을 받아 악성행위를 수행한다.
Disguised AppleSeed distribution · July
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 20 of 37). RGB Unit: Kimsuky; Case Name: Disguised AppleSeed distribution; SPH √; KAC √; VAS: (blank); Publicized Month: July. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
AppleSeed Disguised as Purchase Order and Request Form Being Distributed (Kimsuky) · 11 July 2022
Annex 77 (Links to reports from Ahnlab’s ASEC), listed under “Kimsuky Group”: “AppleSeed Disguised as Purchase Order and Request Form Being Distributed (Kimsuky)” (11 July 2022)