APT trends report Q3 2022 (DPRK-related paragraph 5)

Kaspersky Securelist

Kimsuky is a prolific and active threat actor primarily targeting North Korea-related entities. Like other sophisticated adversaries, this group also updates its tools frequently. Recently, however, we had a chance to take a thorough look at how they configure their C2 servers and what kind of tricks they use to confirm and further validate their victims. The Kimsuky group configured multi-stage C2 servers with various commercial hosting services located around the world. We believe the attacks occur in several stages. First, the actor sends a spear-phishing email to the potential victim with a lure to download additional documents. If the victim clicks the link, it results in a connection to the first stage C2 server, with an email address as a parameter. The first stage C2 server verifies that the incoming email address parameter is an expected one and delivers the malicious document if it’s in the target list. The first stage script also forwards the victim’s IP address to the next stage server. When the fetched document is opened, it connects to the second C2 server. The corresponding script on the second C2 server checks the IP address forwarded from the first stage server, to verify that it’s an expected request from the same victim. Using this IP validation scheme, the actor verifies whether the incoming request is from the victim or not. On top of that, the operator relies on several other processes to carefully deliver the next payload. Another C2 script on the second C2 server checks operating system type and predefined user-agent strings, to filter out requests from security researchers or auto-analysis systems. Our research underlines how the Kimsuky threat actor pays close attention to validating legitimate victims and delivering the next stage payloads to them.