New Baby Shark Malware Targets U.S. National Security Think Tanks
Summary: Unit 42 identified spear phishing emails sent in November 2018, written to appear from a U.S.-based nuclear security consultant and referencing North Korea's nuclear issues, that carried a malicious Excel macro document delivering a new VB script-based malware family called BabyShark. BabyShark loads a first-stage HTA from a remote server, exfiltrates system information to a command-and-control server, enables macros across Word and Excel via registry keys, and maintains persistence through a Command Processor AutoRun key and scheduled tasks.
Key Takeaway: The decoy documents included content that was not publicly available, leading Unit 42 to suspect the actor compromised someone with access to private documents at a U.S. national security think tank - and the campaign was still ongoing at the time of publication.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026