Kimsuky

  • First known sample

    2011
  • Discovery

    2013
  • Number of targets

    1-100
  • Current status

    Active
  • Type

    Backdoor
  • Targeted platforms

    Windows
  • TOP targeted countries

    South Korea
  • The way of propagation

    USB drives
  • Purpose/Functions

    Cyberespionage , Data wiping , Remote control
  • Special features
    Email accounts on various public mail services are used to control bots and serve as drop zones.
  • Targets

    Academia/Research , Government entities , Private companies
  • Artefacts/Attribution
    Strings left by malware author in the compile paths of the malicious samples' bodies suggest the attack has Korean origins. Also we have been able to define the IP addresses from which attackers visited their email accounts to control the bots. All those IP addresses turned out to be Chinese areas bordering North Korea. Internet Providers from these areas are believed to provide Internet into North Korea. All this, as well as the fact that the targets are of specific interest to the North Korean government, could suggest that North Korea might be behind this threat actor.
  • Description

    A cyber-espionage actor involved in attacks targeting South Korean think tanks. Initial infection is with a Trojan dropper that subsequently downloads more malware, each of which carries its own spying function.

    Additional information