Malware Disguised as Normal Documents (Kimsuky) · 2023-02-03
excerpt: The ASEC analysis team has recently discovered that the malware introduced in the post, <Malware Disguised as a Manuscript Solicitation Letter (Targeting Security-Related Workers)>, is being distributed to broadcasting and ordinary companies as well as those in the security-related field. Identical to the malware introduced in the blog post above, all the malware documents utilize […] | attribution sentence: Word File Provided as External Link When Replying to Attacker’s Email (Kimsuky) Below is a list of download URLS of malicious Word macro documents we have additionally identified. | target sentence: The ASEC analysis team has recently discovered that the malware introduced in the post, < Malware Disguised as a Manuscript Solicitation Letter (Targeting Security-Related Workers) > , is being distributed to broadcasting and ordinary companies as well as those in the security-related field.
정상 문서로 위장한 악성코드(kimsuky) · 2023-02-03
excerpt: ASEC 분석팀은 최근 <원고 청탁서로 위장한 악성코드 (안보 분야 종사자 대상)>에서 소개한 악성코드가 안보 분야 뿐만 아니라 방송 및 일반 기업들을 타겟으로 유포 중임을 확인하였다. 해당 악성 문서들은 모두 위 블로그 글에서 소개한 악성코드와 동일하게 템플릿 인젝션(Template Injection) 기법을 사용하고 있으며 악성 워드 매크로 문서를 다운로드 받아 실행한다. 확인된 유포 파일명은 다음과 같다. [kbs 일요진단]질문지.docx 임** 자기소개서.docx […] | attribution sentence: 공격자 메일에 회신한 경우에 외부 링크로 제공되는 워드문서 (Kimsuky) – ASEC BLOG ASEC 분석팀은 대북 관련 내용의 악성 워드 문서가 꾸준히 유포되고 있음을 확인하였다. | target sentence: ASEC 분석팀은 최근 < 원고 청탁서로 위장한 악성코드 (안보 분야 종사자 대상) > 에서 소개한 악성코드가 안보 분야 뿐만 아니라 방송 및 일반 기업들을 타겟으로 유포 중임을 확인하였다.
Malware Disguised as Normal Documents (Kimsuky) · February
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 4 of 75, PDF p. 319). DPRK cyber actor: Kimsuky; Report Name: Malware Disguised as Normal Documents (Kimsuky); Case Summary: Same tactics used as in Malware Disguised as a Manuscript Solicitation Letter (Targeting Security-Related Workers ;in this case, the threat actor used an image that prompts users to execute the macro.; Publication Month: February
Malware Disguised as Normal Documents (Kimsuky) · 15 February 2023
Annex 64 (Links to Ahnlab Security Emergency Response Center (ASEC) reports in 2023 (as of July 2023); Source: ASEC), listed under “Kimsuky Group”: “Malware Disguised as Normal Documents (Kimsuky)” (15 February 2023)