Analysis Summary

Kimsuky is a North Korean advanced persistent threat (APT) group, also known as "Black Banshee". The group has been active since at least 2012 and is believed to be state-sponsored. Kimsuky is known for conducting cyber espionage operations and targeting organizations and individuals in various countries, including South Korea, Japan, and the United States. The group has been observed using various techniques to compromise its targets, such as phishing attacks, malware infections, and supply chain attacks. The group's ultimate goals and motivations are not well understood, but they are generally believed to be focused on intelligence gathering and political or economic gain. The tactics, techniques, and procedures (TTPs) used by the Kimsuky APT group are constantly evolving, but some of their most commonly used methods include:

• Phishing attacks: The group has been known to send phishing emails that contain malicious attachments or links to compromised websites.
• Malware infections: Kimsuky has been observed using various types of malware, including remote access trojans (RATs), backdoors, and wiper malware.
• Supply chain attacks: The group has been known to compromise legitimate software or websites to distribute malware to a wider audience.
• Lateral movement: Once the group has compromised a target, they use techniques such as network scanning, password cracking, and privilege escalation to move laterally within the victim's network.
• Data exfiltration: Kimsuky has been observed using various methods to steal data from its targets, including command-and-control servers, cloud storage services, and removable media.

In October 2022, Kimsuky was observed using mobile malware to target Android devices. Researchers gave the malicious APKs the names FastFire, FastViewer, and FastSpy by including the word Fast in the package name and describing each one's characteristics. This group has been conducting constant attacks on mobile devices to steal the target's information. Their sophisticated technique is Firebase, a standard service employed as the C&C server in FastFire. Furthermore, some attempts are being made to avoid detection by modifying Androspy, an open-source RAT. Sophisticated attack vectors, similar to FastViewer, are utilized to attack specified targets, and existing open sources are being leveraged to produce high-performance variations such as FastSpy. FastViewer and FastSpy were employed to attack South Koreans and all three APKs. The mobile targeting approach of the Kimsuky group is becoming more advanced, thus it is important to be cautious about sophisticated attacks aimed at Android smartphones or devices.

In May 2023, the Kimsuky group was observed using a new version of its reconnaissance malware, called ReconShark (an evolution of the threat actor's BabyShark malware toolset), in a global cyberespionage campaign. The malware is designed to gather information on targeted systems and exfiltrate that data back to the attackers. It is believed that the group uses this information to gain access to sensitive networks and steal valuable intellectual property.

Impact

• Data Theft and Espionage
• Sensitive Data Exposure

Indicators of Compromise

Domain Name

• woana.n-e.kr
• vamboo.n-e.kr
• update.screawear.ga
• peras1.n-e.kr
• onsungtong.n-e.kr
• nomera.n-e.kr
• nocamoto.o-r.kr
• nauji.n-e.kr
• jieun.dothome.co.kr
• hyper.cadorg.p-e.kr
• download.uberlingen.com
• dirwear.000webhostapp.com
• afcafe.kro.kr

MD5

• 2f6fe22be1ed2a6ba42689747c9e18a0
• 7a0c0a4c550a95809e93ab7e6bdcc290
• 7756b4230adfa16e18142d1dbe6934af
• 8346d90508b5d41d151b7098c7a3e868
• 30741e7e4cdd8ba9d3d074c42deac9b1
• 537806c02659a12c5b21efa51b2322c1
• b9c2111c753b09e4cc9d497f8fd314fc
• ca3926dc6c4b2a71832a03fba366cbcd
• ec9dcef04c5c89d6107d23b0668cc1c1
• f14f332d4273de04ba77e38fd3dcff90
• 1ae2e46aac55e7f92c72b56b387bc945

SHA-256

• de60612226ea59961e655ad83d23fb501be0e5ea4f0ba4aab4e30495abfaf742
• c1958894129800843f627bc791ae046f9f4c5b26a4cb7bd7b6d684b110be690a
• 6a38c84efe52d8e7298d62809ef59a28b74575f09e7199a6b7f6bf3762a2de44
• 24a42a912c6ad98ab3910cb1e031edbdf9ed6f452371d5696006c9cf24319147
• d66c69b99e978727d5ffdf75ab0c969b80c297dd41a648f97bf241264e62afc5
• 3314b6ea393e180c20db52448ab6980343bc3ed623f7af91df60189fec637744
• cb5a57021b10d281720cc353697518e181688f1a1f70808a59f6a4832432eac4
• 5b8f6d76e9f63920654266814daa12e80ad13cf07e87c29a9a8e167a7bf4ea4a
• ddd13d9ddcef9c3e96be9280a756907be0b7a014451e07e0857ce7738f67045f
• 84f4f2e77b6e59c1fe54360842821fbfc6cdab039f197147b30876ed7da3647c
• 6d8c5194c7e728b394c5f419d666ed8f178e696c707fd6071f7bf33a2e6e8b79

SHA-1

• 44ac07c6f2daf0c1b2778e216ece44e8708bd009
• a9d3519f65889f411ec00dd9fd22e94403bf37e5
• 9e05b7b0cf99b9b12333d24b3e93348f8f7c0295
• 20ea6517f4490dc504756299263a06b1cc8e87e0
• 7ffd3f157f4a58e8253560676baa9efcf157cd25
• c90a00b80670da65da968e0503f41b433888b9d2
• f28e3aff6df8bc8badcee45af5cc431285894fbe
• a81f4b43ecf32c7824dfa7caa603a799104c4fd4
• 43d43312ebf9123e805e7e56e719d9a72f4ce70e
• ff10fff72e3c5c65692d7b1efbb61096057a75f1
• b8dca661d0ce76e5a8b447de6fc1a864768289fa

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• It is also recommended that individuals and organizations use secure and encrypted communication channels, such as VPNs and encrypted email when transmitting sensitive information.
• Additionally, the use of multi-factor authentication can help reduce the risk of sensitive information being stolen by attackers.