Kaspersky Securelist
IT threat evolution Q3 2022 (DPRK-related paragraph 5) · 2022-11-18
Based on the contents of the decoy document, we hypothesize that the targets of this operation are people or entities related to political or diplomatic activities. We know that historically politicians, diplomats, journalists, professors and North Korean defectors have been prime targets of the Kimsuky group. The email address names from the C2 scripts help to confirm this hypothesis.