Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy

Summary: Unit 42 researchers found two malware samples used by the North Korean APT group Sparkling Pisces (aka Kimsuky): an undocumented C++ keylogger the authors call KLogExe, and a previously undocumented FPSpy backdoor variant first uploaded to VirusTotal on June 26, 2024, though its compilation timestamp dates to 2018. KLogExe writes collected data to C:\Users\user\AppData\Roaming\Microsoft\desktops.ini and exfiltrates it over HTTP to a C2 URI, while FPSpy is a DLL named sys.dll with an export called MazeFunc, dropped by a loader into a WPSOffice folder and using the C2 subdomain bitjoker2024.000webhostapp[.]com, first seen in 2024.

Why it matters: The group nicknamed 'the king of spear phishing' has run hundreds of attacks and previously hit Korea Hydro and Nuclear Power in 2014; its newest backdoor carries a 2018 compilation timestamp but a 2024 C2 domain, so timestamps on files in your environment will not tell you how fresh the threat is.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026