Kaspersky Securelist
IT Threat Evolution: Q3 2013 (DPRK-related paragraph 3) · 2013-11-14
Although the initial delivery mechanism remains unknown, Kaspersky researchers believe the Kimsuky malware is most likely delivered via spear-phishing emails and has the ability to perform the following espionage functions: keystroke logging, directory listing collection, remote control access and HWP document theft (related to the South Korean word processing application from the Hancom Office bundle, extensively used by the local government). The attackers use a modified version of the TeamViewer remote access application to serve as a backdoor to hijack any files from the infected machines.