UN Panel of Experts S/2024/215
kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/ · May
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 21 of 75, PDF p. 322). DPRK cyber actor: Kimsuky; Report Name: kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/; Case Summary: Kimsuky waged a phishing campaign inviting exchanges on current geopolitical issues, to lure targets globally and deployed a new reconnaissance tool, ‘ReconShark,’ which collects sensitive data and bypasses security mechanisms. The ‘ReconShark’ malware was activated when the target opened a downloaded document and enabled macros. ‘ReconShark’ stole data from infected systems, such as endpoint detection and response (EDR) mechanisms and sent the stolen data to a C2 C2 server via Windows Management Instrumentation (WMI).; Publication Month: May