Kaspersky report on APT trends in Q3 2024 (DPRK-related paragraph 1)

Kaspersky Securelist

We have observed that the Kimsuky group uses a strategy of registering malware as a service for reliable persistence. The so-called ServiceChanger malware drops a malicious DLL file and registers a service disguised as a legitimate service. In the case we analyzed, ServiceChanger installed the TOGREASE malware, which is an evolved version of GREASE that adds the ability to toggle RDP activation when necessary by the operator; and in another instance, it was observed installing the XMRig miner.