University Lecturers Targeted by North Korean Cyber Espionage Faction
A faction linked to North Korea referred to as Kimsuky has been associated with a fresh series of assaults aimed at university staff, scholars, and instructors for the purpose of intelligence accumulation.
Security company Resilience stated that it detected the activity towards the end of July 2024 following an operational security (OPSEC) error committed by the intruders.
Kimsuky, also recognized by the aliases APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet, Springtail, and Velvet Chollima, is just one of the numerous aggressive cyber groups functioning under the oversight of the North Korean administration and armed forces.
It also proactively engages, often using spear-phishing campaigns as an initial step to release an ever-growing collection of specialized utilities to perform groundwork, siphon data, and set up continuous remote entry to affected systems.
The assaults are also marked by the utilization of compromised systems as staging systems to deploy an obscured variation of the Green Dinosaur web shell, which is subsequently employed for file operations. Kimuksy’s usage of the web shell was previously brought to attention by security researcher blackorbird in May 2024.
The access facilitated by Green Dinosaur is then misused to upload pre-designed phishing pages that are crafted to imitate genuine login interfaces for Naver and various colleges such as Dongduk University, Korea University, and Yonsei University with the objective of seizing their login credentials.
Subsequently, the victims are directed to a different site pointing to a PDF document hosted on Google Drive that falsely claims to be an invite to the Asan Institute for Policy Studies August Forum.
“Furthermore on Kimsuky’s phishing websites, there’s a generic phishing tool to collect Naver accounts,” Resilience researchers mentioned.
“This tool is a basic proxy comparable to Evilginx for filching cookies and credentials from visitors and presents pop-ups notifying users they must log in again due to disruption in server communication.”
The examination has also revealed a customized PHPMailer utility employed by Kimsuky termed SendMail, which is utilized to distribute phishing emails to the targets via Gmail and Daum Mail accounts.
To thwart the danger, it’s advised that users activate anti-phishing multi-factor authentication (MFA) and thoroughly inspect the URLs before authentication.
About Author
