CYFIRMA research
Moonstone Sleet, Lazarus Kaolin RAT and Kimsuky Gomir/ReconShark activity · Q2 2024 (from title: APT Quarterly Highlights : Q2 2024)
Kimsuky (Springtail) targeted South Korea with the new Gomir backdoor and sophisticated social engineering attacks, including the ReconShark malware via Facebook and the TRANSLATEXT Chrome extension. Moonstone Sleet (Storm-1789) engaged in financial and cyber espionage using fake companies, custom ransomware, and trojanized tools. The Lazarus Group used fake job lures to deliver the Kaolin RAT and exploited vulnerabilities for security bypasses.