Kaspersky Securelist
Kaspersky report on APT trends in Q3 2024 (DPRK-related paragraph 2) · 2024-11-28
In addition, this year’s updated version of the GREASE malware creates backdoor accounts to use RDP connections under the names “Guest” and “IIS_USER”, respectively. They borrow code from the publicly available UACME, allowing them to bypass UAC and execute commands with escalated privileges. Uniquely, the resources section within the GREASE malware includes a Zoom Opener installer vulnerable to DLL hijacking, which has not been observed in use by Kimsuky. However, it is possible that they may create malware that exploits this vulnerability in the future.