S2W TALON blog (medium.com/s2wblog)
Kimsuky group appears to be exploiting OneNote like the cybercrime group · 2023-03-17
attribution sentence: Author : BLKSMTH | S2W TALON Last Modified : Mar 17, 2023 Photo by Ed Hardie on Unsplash Executive Summary We have confirmed that the Kimsuky group is distributing malware using a malicious OneNote (.ONE) file, which cybercriminals have widely used. | target sentence: When viewed, the ONE file displays an image of the Institute for Peace and Democracy at Korea University and asks the target to fill out a privacy agreement document in order to pay them for participating in a survey.