Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub) · 2023-03-23
excerpt: AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of a malicious Word file disguised as a profile template from emails impersonating a certain professor. ‘[Attachment] Profile Template.doc’ is the filename of the password-protected Word file that was discovered, with the password itself being included in the body of the email. Figure 1. Original […] | attribution sentence: Data uploaded to GitHub Additionally, there has recently been a confirmed case of the Red Eyes threat group (also known as APT37, ScarCruft) also using GitHub as their malware distribution site.
Kimsuky 그룹, 약력 양식 파일로 위장한 악성코드 유포 (GitHub) · 2023-03-23
excerpt: AhnLab Security Emergency response Center(ASEC)에서는 특정 교수를 사칭하여 약력 양식 내용으로 위장한 워드 문서를 이메일을 통해 유포한 것을 확인했다. 확인된 워드 문서의 파일명은 ‘[붙임] 약력 양식.doc’이며 문서에는 암호가 설정되어 있는데 이메일 본문에 비밀번호가 포함되어 있다. 워드 문서 내에 악성 VBA 매크로가 포함되어 있으며 매크로 활성화 시 PowerShell을 통해 C2에 접속하여 추가 스크립트를 […] | attribution sentence: GItHub에 업로드된 정보 또한, 최근 Red Eyes 공격 그룹(also known as APT37, ScarCruft)도 GitHub를 악성코드 유포지로 활용하는 사례도 확인되었다.
Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub) · March
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 10 of 75, PDF p. 320). DPRK cyber actor: Kimsuky; Report Name: Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub); Case Summary: Kimsuky distributed a malicious Word file disguised as a profile template from emails impersonating a well -known professor. A malicious VBA macro is contained within the Word file; upon being activated, it connects to a C2 server via PowerShell before downloading and executing an additional script that uses the GitHub API to transmit user information to a specified repository.; Publication Month: March
Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub) · 29 March 2023
Annex 64 (Links to Ahnlab Security Emergency Response Center (ASEC) reports in 2023 (as of July 2023); Source: ASEC), listed under “Kimsuky Group”: “Kimsuky Group Distributes Malware Disguised as Profile Template (GitHub)” (29 March 2023)