Forest Global Training Partners

Cyber Risks · Cisco Talos

North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets

Summary: Cisco Talos reported that the North Korean Kimsuky APT group has run a campaign since at least June 2021 using malicious Blogspot posts to deliver implants derived from the Gold Dragon and Brave Prince families to South Korean geopolitical and aerospace research agencies. The chain begins with macro-laden Office documents disguised as forms, drops VBScript stages that query the blog for base64-encoded content at each login, and deploys a beacon, a file exfiltrator, and an implant instrumentor that includes a trojanized Nirsoft WebBrowserPassview credential stealer.

Bottom line: The exfiltrator pulled from a remote file list naming exact paths such as "North Korean defector interview.hwp" and a denuclearization document, which Talos reads as evidence the attackers already knew the targets' endpoints from prior compromises. A public blogging service served as the payload channel, and the implant re-checks it at every login, so the content can change after your initial detection.

Read the original at Cisco Talos ↗

Topics
Malware
Related