AhnLab ASEC blog (asec.ahnlab.com)
Case of Larva-25004 Group (Related to Kimsuky) Exploiting Additional Certificate – Malware Signed with Nexaweb Certificate · 2025-05-22
excerpt: AhnLab SEcurity intelligence Center (ASEC) has discovered malware signed with the certification of Nexaweb Inc. by investigating a file with the same characteristics as the one signed with a Korean company’s certificate. These malware samples have been reported by other security companies about the activities of the Kimsuky group. AhnLab is tracking them, naming […] | attribution sentence: These malware samples have been reported by other security companies about the activities of the Kimsuky group. | target sentence: The exact target is unknown, but considering that the document is a bait, it is likely to be intended for those interested in working for a defense company.