Kimsuky

Email accounts on various public mail services are used to control bots and serve as drop zones.

Strings left by malware author in the compile paths of the malicious samples' bodies suggest the attack has Korean origins. Also we have been able to define the IP addresses from which attackers visited their email accounts to control the bots. All those IP addresses turned out to be Chinese areas bordering North Korea. Internet Providers from these areas are believed to provide Internet into North Korea. All this, as well as the fact that the targets are of specific interest to the North Korean government, could suggest that North Korea might be behind this threat actor.

A cyber-espionage actor involved in attacks targeting South Korean think tanks. Initial infection is with a Trojan dropper that subsequently downloads more malware, each of which carries its own spying function.

Additional information