Analysis of the recent Endoor malware of Kimsuky (APT-Q-2) group

QiAnXin Threat Intelligence Center (RedDrip)

Kimsuky, alias Mystery Baby, Baby Coin, Smoke Screen, Black Banshe, etc., is tracked internally as APT-Q-2\ by Qi'anxin. The APT group was publicly disclosed in 2013, with attacks dating back to 2012, Kimsuky's main targets are South Korea, defense, education, energy, government, healthcare, and think tanks, with a focus on stealing classified information. The group typically delivers malware using social engineering, spearmail, and puddle attacks, and has a wide range of attack tactics, with weapons for both Windows and Android platforms.