OneNote Malware Disguised as Compensation Form (Kimsuky) · 2023-03-20
excerpt: AhnLab Security Emergency response Center (ASEC) has discovered the distribution of a OneNote malware disguised as a form related to compensation. The confirmed file is impersonating the same research center as the LNK-type malware covered in the post below. Based on the identical malicious activity performed by the VBS files, the team has deduced that […] | attribution sentence: Due to recent confirmed cases of the Kimsuky group distributing malware in various forms such as CHM, LNK, and OneNote, which were previously distributed as Word files, users are strongly advised to exercise extra caution. | target sentence: Malware Disguised as a Manuscript Solicitation Letter (Targeting Security-Related Workers) Afterward, it downloads and opens an HWP file from hxxp://delps.scienceontheweb.net/ital/info/sample.hwp through a PowerShell command.
사례비 지급 내용으로 위장한 OneNote 악성코드 (Kimsuky) · 2023-03-20
excerpt: AhnLab Security Emergency response Center(ASEC)에서는 사례비 지급 내용으로 위장한 원노트(OneNote) 악성코드가 유포 중임을 확인하였다. 확인된 파일은 아래 블로그에 작성된 LNK 유형의 악성코드와 동일한 연구소를 사칭하고 있으며 실행되는 VBS 파일의 악성 행위가 유사한 것으로 보아 동일 공격 그룹의 소행으로 확인된다. 원 노트 파일 실행 시 다음과 같이 사례비 지급 내용을 담고 있으며, 한글 문서가 첨부된 것으로 […] | attribution sentence: 최근 Kimsuky 그룹에서 워드 문서로 유포하였던 악성코드를 CHM, LNK, OneNote 등 다양한 형식의 악성코드로 유포하고 있는 것이 확인되어 사용자의 각별한 주의가 필요하다. | target sentence: 원고 청탁서로 위장한 악성코드 (안보 분야 종사자 대상) ASEC 분석팀은 01월 08일 안보 분야 종사자를 대상으로 원고 청탁서로 위장한 문서형 악성코드 유포 정황을 확인하였다.
OneNote Malware Disguised as Compensation Form (Kimsuky) · March
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 9 of 75, PDF p. 320). DPRK cyber actor: Kimsuky; Report Name: OneNote Malware Disguised as Compensation Form (Kimsuky); Case Summary: Kimsuky distributed OneNote malware disguised as a form related to compensation. Once a user clicks on the script, the malicious VBS file iscreated and executed under the filename personal.vbs in a temporary directory to steal user information.; Publication Month: March
OneNote Malware Disguised as Compensation Form (Kimsuky) · 24 March 2023
Annex 64 (Links to Ahnlab Security Emergency Response Center (ASEC) reports in 2023 (as of July 2023); Source: ASEC), listed under “Kimsuky Group”: “OneNote Malware Disguised as Compensation Form (Kimsuky)” (24 March 2023)