AhnLab ASEC blog (asec.ahnlab.com)
Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey) · 2023-12-01
excerpt: OverviewInitial Access…. 2.1. Spear Phishing Attack…. 2.2. LNK MalwareRemote Control Malware…. 3.1. XRat (Loader)…. 3.2. Amadey…. 3.3. Latest Attack Cases…….. 3.3.1. AutoIt Amadey…….. 3.3.2. RftRATPost-infection…. 4.1. Keylogger…. 4.2. Infostealer…. 4.3. Other TypesConclusion 1. Overview The Kimsuky threat group, deemed to be supported by North Korea, has been active since 2013. At first, they a | attribution sentence: Overview The Kimsuky threat group, deemed to be supported by North Korea, has been active since 2013. | target sentence: While most target account credentials and cookies saved in web browsers, there are types that collect files in the “Local Extension Settings” path, which is the configuration data related to Chrome extensions.