Pierluigi Paganini
April 21, 2025
While investigating a security breach, the AhnLab SEcurity intelligence Center (ASEC) researchers discovered a North Korea-linked group Kimsuky ‘s campaign, tracked as Larva-24005. Attackers exploited an RDP vulnerability to gain initial access to the target systems.
“In some systems, initial access was gained through exploiting the RDP vulnerability (BlueKeep, CVE-2019-0708). While an RDP vulnerability scanner was found in the compromised system, there is no evidence of its actual use.” reads the report published by ASEC. “The threat actor also used other means to distribute the malware, such as attaching the same file to emails and exploiting the Microsoft Office Equation Editor vulnerability (CVE-2017-11882)[1].”
Once they gained access to the systems, the threat actors modified the configuration by installing MySpy malware and RDPWrap to maintain remote access.
In the final stage, the attackers deployed KimaLogger or RandomQuery keyloggers to record keystrokes. Experts observed Kimsuky sending phishing emails targeting Korea and Japan from compromised systems.
Since September 2023, the North Korean APT has targeted organizations in South Korea, the U.S., China, Japan, Germany, Singapore, and several other countries. Their activity includes phishing campaigns against South Korea and Japan and attacks on South Korea’s software, energy, and financial sectors starting in October 2023.
ASEC researchers also published indicators of compromise (IoC) for this campaign.
Kimsuky cyberespionage group (aka ARCHIPELAGO, Black Banshee, Thallium, Velvet Chollima, APT43) was first spotted by Kaspersky researchers in 2013. The group works under the control of the Reconnaissance General Bureau (RGB) foreign intelligence service. At the end of October 2020, the US-CERT published a report on Kimusky’s recent activities that provided information on their TTPs and infrastructure.
The APT group mainly targets think tanks and organizations in South Korea, other victims were in the United States, Europe, and Russia.
In February, ASEC researchers observed North Korea’s Kimsuky APT group conducting spear-phishing attacks to deliver forceCopy info-stealer malware.
The state-sponsored hackers sent spear-phishing messages to distribute malicious *.LNK shortcut files, disguised as Office documents. When opened, they execute PowerShell or Mshta to download malware like PebbleDash and RDP Wrapper, to control the infected systems.
The attackers use a custom-built RDP Wrapper to enable remote desktop access, likely modifying export functions to evade detection.
The researchers noticed that the threat actors also install proxy malware to achieve external access to the infected systems that are located in a private network.
The Kimsuky group uses keyloggers in multiple file formats, including a PowerShell script.
Kimsuky also used the forceCopy stealer malware to capture keystrokes and extract files from browser directories.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs –hacking, Kimsuky)
