AhnLab ASEC blog (asec.ahnlab.com)
Web Page Disguised as a Naver Login Page · 2023-02-01
excerpt: On January 3rd, the ASEC analysis team covered a situation where a fake Kakao login page was used to steal the account credentials of certain individuals. https://asec.ahnlab.com/en/45437/ The team has confirmed that the threat actor used a vulnerable website to create a domain. The same method described in the above post was used to create […] | attribution sentence: Judging from the reverse DNS data-related IP/domain addresses and relevant files collected by the ASEC analysis team, it is assumed that the Kimsuky group is behind this act.