SharpTongue deploying SHARPEXT · July
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 18 of 37). RGB Unit: Kimsuky; Case Name: SharpTongue deploying SHARPEXT; SPH √; KAC √; VAS: (blank); Publicized Month: July. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
“SHARPEXT” malicious browser extension campaign
Para 139: “A cybersecurity company informed the Panel that Kimsuky (which it calls “Sharptongue”) had been observed deploying malware that uses a malicious browser extension called “SHARPEXT” to hack emails and steal information. ... The “SHARPEXT” campaign is reported to have been targeting organizations in multiple Member States that work on nuclear weapons and other issues that the Democratic People’s Republic of Korea deems important to its national security.”