Kimsuky Group Uses ADS to Conceal Malware · 2023-03-24
excerpt: AhnLab Security Emergency response Center (ASEC) has discovered that the Kimsuky group is using Alternate Data Stream (ADS) to hide their malware. This malware is an Infostealer that collects data by starting the VBScript included inside an HTML file. It can be characterized by its tendency to add the actual code between numerous dummy codes. […] | attribution sentence: AhnLab Security Emergency response Center (ASEC) has discovered that the Kimsuky group is using Alternate Data Stream (ADS) to hide their malware.
Kimsuky 그룹, ADS를 활용하여 악성코드 은폐 · 2023-03-24
excerpt: AhnLab Security Emergency response Center(ASEC)에서는 Kimsuky 그룹이 악성코드를 은폐하는데 ADS(Alternate Data Stream)를 활용하는 것을 확인했다. 해당 악성코드는 HTML 파일 내부에 포함된 VBScript를 시작으로 정보를 수집하는 Infostealer 유형이며 수많은 더미 코드 사이에 실제 코드가 포함된 것이 특징이다. 터미널에서 아래와 같은 명령어를 실행하여 정보를 수집하고 전송한다. hostname systeminfo net user query user route print ipconfig […] | attribution sentence: AhnLab Security Emergency response Center(ASEC)에서는 Kimsuky 그룹이 악성코드를 은폐하는데 ADS(Alternate Data Stream)를 활용하는 것을 확인했다.
Kimsuky Group Uses ADS to Conceal Malware · March
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 11 of 75, PDF p. 321). DPRK cyber actor: Kimsuky; Report Name: Kimsuky Group Uses ADS to Conceal Malware; Case Summary: Kimsuky used Alternate Data Stream (ADS) to hide their malware, an Infostealer that collects data by starting the VBScript included inside an HTML file.; Publication Month: March
Kimsuky Group Uses ADS to Conceal Malware · 29 March 2023
Annex 64 (Links to Ahnlab Security Emergency Response Center (ASEC) reports in 2023 (as of July 2023); Source: ASEC), listed under “Kimsuky Group”: “Kimsuky Group Uses ADS to Conceal Malware” (29 March 2023)