SecuriTricks - kimsuky

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

A sophisticated spearphishing campaign targeting South Korea has been uncovered, utilizing GitHub as attack infrastructure. The threat actor, linked to the North Korean group Kimsuky, created multiple private repositories to store malware, decoy files, and exfiltrated victim data. The attack levera…

north korea

spearphishing

Published: June 26, 2025

Downloadable IOCs: 16

Analysis of the Triple Combo Threat of the Kimsuky Group

The Genians Security Center (GSC) detected an APT (Advanced Persistent Threat) campaign targeting users of Facebook, email, and Telegram in Korea between March and April 2025. The threat actor explored reconnaissance and selected attack targets through two Facebook accounts.

Published: June 11, 2025

Downloadable IOCs: 14

Case of Larva-25004 Group (Related to Kimsuky) Exploiting Additional Certificate - Malware Signed with Nexaweb Certificate

AhnLab Security Intelligence Center discovered malware signed with Nexaweb Inc.'s certificate, linked to the Kimsuky group's activities. The malware, tracked as Larva-25004, was found in two files signed on May 24 and 28, 2024. When executed, it displays a PDF file related to employment as bait, li…

kimsuky

2025-05-23

certificate exploitation

signed malware

nexaweb

certificate leak

Published: May 23, 2025

Downloadable IOCs: 3

APT attack discovered using Facebook and MS management console (Attack signs detected targeting Korea and Japan)

A threat actor impersonated a North Korean human rights official on Facebook and approached targets. They shared malicious URLs disguised as documents. Microsoft OneDrive cloud service was used to host the malicious MSC file, which communicated with C2 servers and deployed Reconshark malware associ…

Published: May 21, 2024

Downloadable IOCs: 46

Tag: kimsuky

Attack reports

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

Analysis of the Triple Combo Threat of the Kimsuky Group

Case of Larva-25004 Group (Related to Kimsuky) Exploiting Additional Certificate - Malware Signed with Nexaweb Certificate

APT Group Profiles - Larva-24005

Inside Kimsuky’s Latest Cyberattack: Analyzing Malicious Scripts and Payloads

Kimsuky: A Gift That Keeps on Giving

Appearance of Kimsuky group's new backdoor (HappyDoor)

APT attack discovered using Facebook and MS management console (Attack signs detected targeting Korea and Japan)