Rewterz Threat Alert – Kimsuky APT Group – Active IOCs

Severity

High

Analysis Summary

Kimsuky is a North Korean nation-state actor that has been active since 2012. It primarily targets South Korean government agencies and conducts espionage activities against targets in the United States and Japan. Kimsuky has dropped a custom backdoor which they are calling Gold Dragon. Kimsuky deploys Gold Dragon, a second-stage backdoor, after a file-less PowerShell-deploying first-stage attack is dropped. 

This group has the ability to put up phishing infrastructure that can effectively imitate well-known websites and fool users into entering their passwords. Kimsuky APT is also known by the names Thallium, Black Banshee, and Velvet Chollima. KISA (Korean Internet & Security Agency) published a full investigation of Kimsuky’s phishing infrastructure and TTPs used to attack South Korea in December 2020. To get Initial Access to victim networks, Kimsuky’s threat actors use a variety of spear phishing and social engineering techniques. This group is responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise, and other major campaigns like Operation Kabar Cobra(2019).

In October 2022, Kimsuky was observed using recently discovered mobile malware to target Android devices. Researchers gave the malicious APKs the names FastFire, FastViewer, and FastSpy by including the word Fast in the package name and describing each one’s characteristics.

The Kimsuky group has been conducting constant attacks on mobile devices in order to steal the target’s information. Their sophisticated technique is Firebase, a standard service employed as the C&C server in FastFire. Furthermore, some attempts are being made to avoid detection by modifying Androspy, an open-source RAT. Sophisticated attack vectors, similar to FastViewer, are utilized to attack specified targets, and existing open sources are being leveraged to produce high-performance variations such as FastSpy. FastViewer and FastSpy were actually employed to attack South Koreans, and all three APKs. The mobile targeting approach of the Kimsuky organisation is becoming more advanced, thus it is important to be cautious about sophisticated attacks aimed at Android smartphones or devices.

Recently, the threat actors used a malicious file named 법제처국가법령정보센터.docx to target South Korea.

Impact

• Information theft and espionage
• Exposure of sensitive data

Indicators of Compromise

MD5

• 40de99fb06e52e3364f2cd70f100ff71
• 1269e2b00fd323a7748215124cb058cd

SHA-256

• e8311bde458b459de78e18ec0c6fbca7087c9124e576955e5bb257df3d3254aa
• 85847cad7f57db4534634d51f7e2c74a23719fcf74c891872d98e7c921f0fd56

SHA-1

• de87429f36935c6610b3e338211dc388cbb290cf
• 18225f0d3be67803a95c9bba02f7f020ccb75e7d

Remediation

• Block all threat indicators at their respective controls.
• Search for IOCs in your environment.
• Always be suspicious about emails sent by unknown senders.