Baby Shark Malware Part Two – Attacks Continue Using Kim JongRAT and PCRat
Summary: Unit 42 reports that BabyShark spear-phishing attacks continued through March and April 2019, expanding from U.S. national think tanks to the cryptocurrency industry. Researchers recovered the malware's server- and client-side files plus two encoded secondary payloads, which decoded to KimJongRAT and PCRat, and found a PHP sample exploiting CVE-2018-8174 on the C2 server though no in-the-wild case was observed.
What you should know: The C2 server keeps a base64-encoded denylist of IP addresses and computer names that made suspicious access attempts and silently withholds the next infection stage from them, so a researcher or defender probing the infrastructure learns nothing while the operator is alerted through a separate log file.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026