Kimsuky’s Phishy Business: North Korean Hackers Hooking Victims with Sneaky Malware
Kimsuky, the notorious North Korea-linked hacking group, is at it again, this time with a new malware named forceCopy. This sneaky stealer targets files in web browser directories, using phishing emails with disguised attachments to launch its attacks. Who knew phishing could be this crafty?
Hot Take:
It seems North Korea’s Kimsuky is back at it again, proving that their spear-phishing game is as sharp as ever. If only they could use their talents for good, like crafting the world’s most secure email filter instead of trying to sneak into our inboxes and steal our secrets. But alas, they’re more interested in playing catfish with our credentials.
Key Points:
- Kimsuky, a North Korea-linked hacking group, is using spear-phishing to deploy the forceCopy malware.
- The attacks start with emails containing a disguised Windows shortcut file.
- The payloads include PEBBLEDASH trojan and a modified RDP Wrapper tool.
- New tactics involve using a PowerShell-based keylogger and forceCopy to steal browser data.
- Kimsuky has a history of targeting with sophisticated social engineering attacks.
Already a member? Log in here