UN Panel of Experts S/2024/215
kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/ · May
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 20 of 75, PDF p. 322). DPRK cyber actor: Kimsuky; Report Name: kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/; Case Summary: Kimsuky deployed a variant of the ‘RandomQuery’ malware via phishing emails to DPRK-focused information services, human rights activists, and DPRK defector support organizations. The Microsoft Compiled HTML Help (CHM) file attached to the phishing emails downloaded ‘RandomQuery’ from the Kimsuky-controlled C2 server to the victim’s system to collect system data.; Publication Month: May