Kaspersky Securelist
Kaspersky report on APT trends in Q3 2024 (DPRK-related paragraph 3) · 2024-11-28
The updated GREASE malware is thought to be connected to the RandomQuery malware also used by Kimsuky, as it communicates with the C2 in a similar manner. The similarity and the overlap between the TOGREASE and GREASE malware used by the Kimsuky group suggests that this group is behind the malware.