Suspicious individuals affiliated with North Korea have been detected utilizing two recent malware variants named KLogEXE and FPSpy.
The operation has been linked to an opponent monitored as Kimsuky, which is also recognized as APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet (previously known as Thallium), Sparkling Pisces, Springtail, and Velvet Chollima.
“These instances boost Sparkling Pisces’ already extensive weaponry and illustrate the faction’s continuous growth and expanding skills,” Daniel Frank and Lior Rochberger, researchers at Palo Alto Networks Unit 42, revealed.
Acting since no less than 2012, the opposing force has been labeled the “monarch of spear phishing” for its talent in deceiving targets into downloading malware by sending emails that present themselves as originating from reliable sources.
An in-depth study conducted by Unit 42 of Sparkling Pisces’ infrastructure has brought out two fresh executable software pieces christened KLogEXE and FPSpy.
KLogExe is a C++ version of the PowerShell-dependent keylogger called InfoKey that was highlighted by JPCERT/CC in relation to a Kimsuky campaign targeting Japanese entities.
The malicious software is equipped with functionalities to accumulate and transmit data about the active applications on the compromised computer, logged keystrokes, and mouse selections.
On the contrary, FPSpy is identified to be an adaptation of the backdoor that AhnLab exposed in 2022, with matches discovered to a malware documented by Cyberseason under the appellation KGH_SPY towards the end of 2020.
FPSpy, aside from keylogging, is also programmed to gather system specifications, fetch and run additional payloads, execute arbitrary commands, and enumerate drives, directories, and files on the infected machine.
Unit 42 revealed that similarities in the source code of both KLogExe and FPSpy have been identified, hinting that they are likely authored by the same individual.
“The majority of targets monitored during our investigation originated from South Korea and Japan, which aligns with past Kimsuky objectives,” declared the researchers.
About Author
