APT trends report Q2 2022 (DPRK-related paragraph 1)

Kaspersky Securelist

In January, Kimsuky, a prolific and active Korean-speaking threat actor, attacked a media company and a think-tank in South Korea. Based on our telemetry, the actor initiated the attack by sending a spear-phishing email containing a macro-embedded Word document. Various examples of different Word documents were uncovered, each showing different decoy content related to geo-political issues on the Korean Peninsula. The actor also took advantage of the HTML application file format to infect the victim using a Hangeul decoy document. After the initial infection, a Visual Basic script was delivered to the victim. As part of this process, the actor abused a legitimate blog service to host a malicious script with an encoded format. The implanted VBS file is capable of reporting information about infected computers and downloading additional payloads with an encoded format. The final stage is an infected Windows executable. Finally, the delivered malware is capable of stealing information from the victim, such as file lists, user keystrokes, and login credentials stored in web browsers. The actor apparently stole sensitive information to leverage its attack. We discovered log files from the attacker’s infrastructure containing numerous IP addresses of more potential victims. Our research revealed multiple overlaps with old Kimsuky malware: this group has used its original malware code and scripts for a long time. However, the infection scheme has been evolving continuously. In this instance, a legitimate blog service was used to reduce suspicion; and infection stages were added to verify the victims. One interesting thing we observed in our research is that the actor used a compromised computer in a victim’s network as its malware testing environment.