Suspected Kimsuky (APT-Q-2) attacks South Korean companies

QiAnXin Threat Intelligence Center (RedDrip)

Kimsuky, alias Mystery Baby, Baby Coin, Smoke Screen, Black Banshe, etc., is tracked internally by Qi'anxin as APT-Q-2.The APT group was publicly disclosed in 2013, with attack activity dating as far back as 2012.Kimsuky's main target for attacks has been South Korea, involving defense, education, energy, government, healthcare, and think tanks, with a focus on classified information theft. The group typically delivers malware using social engineering, spearmail, and puddle attacks, and has a wide range of attack tactics, with weapons for both Windows and Android platforms.