The North Korean state-sponsored threat actor known as Kimsuky has been discovered using a new recognition tool called ReconShark as part of an ongoing global campaign.
“[ReconShark] is actively delivered to specifically targeted individuals through phishing emails, OneDrive links that lead to document downloads, and the execution of malicious macros,” said SentinelOne researchers Tom Hegel and Aleksandar Milenkoski.
Kimsuky is also known by the names APT43, ARCHIPELAGO, Black Banshee, Nickel Kimball, Emerald Sleet (formerly Thallium) and Velvet Chollima.
Active since at least 2012, the prolific threat actor has been linked to attacks targeting non-governmental organizations (NGOs), think tanks, diplomatic agencies, military organizations, economic groups and research entities in the Americas. North, Asia and Europe.
The latest suite of intrusions documented by SentinelOne leverages geopolitical issues related to North Korea’s nuclear proliferation to trigger the infection sequence.
“In particular, phishing emails are made with a quality level of design tailored to specific people, increasing the likelihood of being opened by the target,” the researchers said. “This includes proper formatting, grammar, and visual cues that appear legitimate to unsuspecting users.”
These messages contain links to captured Microsoft Word documents hosted on OneDrive to deploy ReconShark, which functions primarily as a reconnaissance tool to execute instructions sent from a server controlled by the actor. It is also an evolution of the threat actor’s BabyShark malware toolkit.
“It exfiltrates system information to the C2 server, maintains system persistence, and waits for further instructions from the operator,” Palo Alto Networks’ Unit 42 said in its February 2019 analysis of BabyShark.
Learn how to stop ransomware with real-time protection
Join our webinar and learn how to stop ransomware attacks with real-time MFA and service account protection.
Save my seat!
ReconShark is specifically designed to extract details about running processes, deployed detection mechanisms and hardware information, suggesting that the tool’s collected data is used to carry out “precision attacks” with malware adapted to the target environment in a way that avoids detection.
The malware is also capable of deploying additional payloads from the server based on “which detection mechanism processes are running on the infected machines.”
The findings add to growing evidence that the threat actor is actively changing its tactics to contact compromised hosts, establish persistence, and gather intelligence stealthily for extended periods of time
“Kimsuky’s ongoing attacks and its use of the new reconnaissance tool, ReconShark, highlight the evolving nature of North Korea’s threat landscape,” SentinelOne said.
Source link
Kimsuky, the North Korean hacking group, has been known to employ increasingly sophisticated tools in order to carry out malicious activities. Their new weapon of choice is ReconShark, a reconnaissance tool that appears to have been custom-made by the group. The tool was first discovered by Ikaroa, a full stack tech company that specializes in cyber security, after a recent spate of cyberattacks originating from the rogue state.
ReconShark was observed scanning popular web applications for vulnerable points of entry. The tool is capable of bypassing existing security systems and gathering sensitive information, such as usernames, passwords and unique identifiers. It also allows for remote command execution and has powerful cryptocurrency capabilities, enabling the attackers to siphon funds without detection.
It is believed that Kimsuky is using the tool to gain access to web servers around the world, to extract vital data that could be exploited for various purposes. The hackers have apparently been using a combination of the tool and traditional methods such as phishing and social engineering to infiltrate systems.
Ikaroa’s researchers were quick to detect the new tool and spotlight what appears to be an escalation in cyber warfare tactics. The company is helping to raise awareness of the threat and has also released a patch to protect users from the malicious activity.
The widespread use of sophisticated tools such as ReconShark highlights the need for vigilance when it comes to online security. Companies and individuals should keep their systems updated and constantly review their security measures in order to stay ahead of potential threats. By investing in the appropriate tools and expertise, they can ensure they stay one step ahead of the hackers.
Ikaroa is committed to providing the highest levels of cyber security and its team of experts is constantly on the lookout for malicious activity of all kinds. The company will continue to monitor the situation and take action as required to protect its customers.
