FastViewer Variant Merged with FastSpy and disguised as a Legitimate Mobile Application · 2023-10-30
attribution sentence: Author : Youngjae Shin, Sebin Lee | BLKSMTH Last Modified : Oct 30, 2023 Photo by Samuel Angor on Unsplash Executive Summary The S2W Threat Analysis team recently hunted and analyzed a new FastViewer sample from the Kimsuky APT group behind North Korea, and found that the group seems to be using a variant of FastViewer. | target sentence: — Past FastViewer and FastSpy analysis reports: (2022–10–24) Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware The variant has been in production since at least July 2023 and, like the initial version, is found to induce installation by distributing repac
https://medium.com/s2wblog/fastviewer-variant-merged-with-fastspy-and-disguised-as-a-legitimate-mobile-application-f3004588f95c · October
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 45 of 75, PDF p. 327). DPRK cyber actor: Kimsuky; Report Name: https://medium.com/s2wblog/fastviewer-variant-merged-with-fastspy-and-disguised-as-a-legitimate-mobile-application-f3004588f95c; Case Summary: Kimsuky has created a FastViewer variant that induces a victim to install the app onto their mobile device by disguising the malware as a legitimate Android application (APK file), such as Google Authenticator, an anti -virus program, or a payment service application. The FastViewer malware receives commands directly from the server without downloading additional malware, and the main purpose of this FastViewer variant is to steal information from infected devices. It appears that Kimsuky has developed this malware since at least July 2023 to target Republic of Korea victims. The report further notes that the disguised applications are expected to be distributed via spearphishing emails or smishing to trick targets into running them.(Annex 59.1); Publication Month: October