The North Korean Kimsuky hacking group was found employing a new version of its reconnaissance malware, now called ‘ReconShark,’ as part of an ongoing cyberespionage global campaign.
The threat actors have expanded their targeting scope, now targeting government organizations, research centers, universities, and think tanks in the United States, Europe, and Asia.
In March 2023, South Korean and German authorities warned that Kimsuky began spreading malicious Chrome extensions that targeted Gmail accounts and an Android spyware that served as a remote access trojan.
According to SentinelOne researchers Tom Hegel and Aleksandar Milenkoski, the malware specifically targets individuals through spear-phishing emails, OneDrive links leading to document downloads, and the execution of malicious macros
Kimsuky is also known by the names APT43, ARCHIPELAGO, Black Banshee, Nickel Kimball, Emerald Sleet (previously Thallium), and Velvet Chollima.
The latest intrusion set documented by SentinelOne leverages geopolitical themes related to North Korea’s nuclear proliferation to activate the infection sequence.
The spear-phishing emails are made with a level of design that includes proper formatting, grammar, and visual clues, appearing legitimate to unsuspecting users.
These messages contain links to booby-trapped Microsoft Word documents hosted on OneDrive to deploy ReconShark, which functions as a recon tool to execute instructions sent from an actor-controlled server.
ReconShark is considered by Sentinel Labs analysts an evolution of Kimsuky’s ‘BabyShark’ malware which was also seen deployed by APT43.
ReconShark is specifically designed to exfiltrate details about running processes, deployed detection mechanisms and hardware information.
The malware is also capable of deploying additional payloads from the server based on “what detection mechanism processes run on infected machines.”
The ongoing attacks from Kimsuky and their use of the new reconnaissance tool, ReconShark, highlight the evolving nature of the North Korean threat landscape.
Image Credits : The diplomat
Comments