Kimsuky’s Cyber Shenanigans: New Malware Campaign Targets Global RDP Vulnerabilities
AhnLab Security Intelligence Center has uncovered a new Kimsuky campaign, exploiting the patched BlueKeep vulnerability in Microsoft Remote Desktop Services. Dubbed Larva-24005, this attack humorously reminds us that even North Korean hackers appreciate a good retro bug—because nothing says “nostalgia” like a 2019 security flaw.
Hot Take:
Looks like North Korea’s Kimsuky crew is back at it again, like that one overzealous neighborhood cat that just can’t let your flowerbed be. This time, they’re playing with some old tricks, exploiting a Microsoft vulnerability so outdated, it probably still uses dial-up.
Key Points:
- Kimsuky, a North Korean threat group, is exploiting a patched Microsoft RDP vulnerability.
- The campaign is dubbed Larva-24005 by ASEC.
- Initial access methods include exploiting CVE-2019-0708 and phishing emails with CVE-2017-11882.
- Malware tools like MySpy and RDPWrap are utilized after access is gained.
- Targets include various sectors in South Korea, Japan, and other global locations.
Already a member? Log in here