Severity
High
Analysis Summary
Kimsuky is a North Korean threat actor active since 2012. It primarily targets South Korean government agencies and conducts espionage activities against targets in the United States and Japan. This group has the ability to put up phishing infrastructure that can effectively imitate well-known websites and fool users into entering their passwords. Kimsuky APT is also known by the names Thallium, Black Banshee, and Velvet Chollima. KISA (Korean Internet & Security Agency) published a full investigation of Kimsuky’s phishing infrastructure and TTPs used to attack South Korea in December 2020. To get Initial Access to victim networks, Kimsuky’s threat actors use a variety of spear phishing and social engineering techniques. This group is responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise, and other major campaigns like Operation Kabar Cobra(2019).
Impact
- Information theft and espionage
- Exposure of sensitive data
Indicators of Compromise
Filename
- Details of in-house financial business[.]zip
- Details of in-house financial business[.]docx
- knla[.]dat
MD5
- 3abe439a9507cac0f5e38d53a87d16da
- 929a87be39ed3ad28e7285340f64414f
- 3ea725814791d4f43c47aa7000eb920b
- 154f13194c8577fbfe820dc28338b3f9
SHA-256
- a0ce0de438f936cc3cca419582ad768d81a32fc122c6ef16a2ca043a6c5869a2
- 5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a
- e670940f547838039103ac1b6992bc09cdebe9e2e598572165a83b35d61435fd
- d5525a16b2d9d78aeb7ca77567c60a52496a434daa4fe12b3bf048faa85c5f45
SHA-1
- 237d44de7fae8125848843fc468fd44da0367bce
- c0af9ae360dfe366adb028e29e95f2152fd0aa77
- 426062cd75a574162e731c607989be895ee3934d
- 298e0b6f534b1b4f5d7d6a4c548b7a61332a688e
URL
- http[:]//ms-work[.]com-info[.]store/dms/0203[.]dotm
- http[:]//ms-work[.]com-info[.]store/home/?id={UserName}&act=wbi&ver={SystemVersion}
- http[:]//ms-work[.]com-info[.]store/home/?act=ucd&id={UserName}&ver={SystemVer}
Remediation
- Always be suspicious about emails sent by unknown senders.
- Never click on links/attachments sent by unknown senders.
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.