UN Panel of Experts S/2024/215
Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey) · December
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 69 of 75, PDF p. 330). DPRK cyber actor: Kimsuky; Report Name: Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey); Case Summary: Kimsuky continues to deploy LNK-type malware, installing remote control malware to control the infected system after gaining initial access. Malware used by the Kimsuky group not only include custom-made such as AppleSeed and PebbleDash, but also open-source or commercial malware such as XRat, HVNC, Amadey, and Metasploit Meterpreter. After gaining control,Kimsuky ultimately uses RDP or installs Google’s Chrome Remote Desktop to exfiltrate information from the infected system. Amadey and RftRAT were constantly used throughout 2023 alongside XRat. However, recent types showed that they were created with AutoIt. Infostealers were additionally installed by the Kimsuky group using remote control malware. While remote control-type malware used by Kimsuky has continuously changed, the malware installed through these have not changed much in the attacks in 2023.; Publication Month: December