Kimsuky Uses Malicious Blogs to Deliver Malware to South Korean Targets
Summary
Talos detailed a Kimsuky campaign targeting South Korean research institutions with malicious Blogspot content that delivered modular malware for reconnaissance, file exfiltration, keylogging, and credential theft. The blogs were taken down before publication.
Key points
- The campaign was active from at least June 2021 and targeted South Korean think tanks, universities, and aerospace research agencies.
- Malicious Office documents with VBA macros initiated infection; persistent scripts then fetched attacker-controlled content from Blogspot.
- Blog posts delivered beacons, file-exfiltration modules, and an instrumentor that deployed information-gathering tools, a keylogger, and a file injector.
- The malware sought specific research files and used a trojanized Nirsoft WebBrowserPassView tool to collect website credentials.
- Talos attributed the activity to Kimsuky with high confidence based on code, tactics, techniques, procedures, and infrastructure overlap.
- Google removed the malicious posts and related indicators before the report was published.
Article Details
- Attack Vectors
- Malicious Microsoft Office documents use VBA macros that activate when a victim types into a disguised form, drop VBScript, and start the infection chain.
- VBScript stages create Startup-folder persistence and retrieve executable content from attacker-operated Blogspot posts.
- The malware gathers system information and selected files, then archives and exfiltrates them to attacker-specified locations.
- A DLL injector deploys payloads into benign processes using process hollowing; the payloads include a keylogger and a trojanized WebBrowserPassView credential stealer.
- The instrumentor deploys DLLs using rundll32.exe and modifies a downloaded DLL's first byte before restoring it for execution.
- Defensive Notes
- Cisco recommends blocking malicious email and web content and detecting associated endpoint, network, and malware activity using its listed security products.
- Cisco Duo is recommended to ensure only authorized users access the network.
- The article says the malicious Blogspot posts had been removed by Google before publication.
- Cisco Secure Endpoint users are directed to Orbital queries for checking endpoints for the described implants.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | pcsecucheck[.]scienceontheweb[.]net | Domain listed in the campaign's network IOCs. |
| SHA256 | 048f3564d5c4d3e0e3b879f33f3b8d340b692f505515e81f192544b98e269ccf | Hash listed for the Stage 3 script. |
| SHA256 | 36187cd4bc18e4d6ddc5c96dc0ed038bfec751dac4f5354398fdaa89d9fcacd1 | Hash listed for a keylogger. |
| SHA256 | 395eebf586d5fc033e22235f7a4224e91ad5dce8570023669c6dee97d04aa21d | Hash listed for a campaign implant. |
| SHA256 | 4b0e2244f82170f4e569bb6b100890ec117458bf5cc835fd7bd991f0d334318b | Hash listed for an injector. |
| SHA256 | 4b244ac09e4b46792661754bd5d386e8b1a168cb1d5ed440df04c1c2928cb84d | Hash listed for the VBA component. |
| SHA256 | 5498c3eb2fb335aadcaf6c5d60560c5d2525997ba6af39b191f6092cb70a3aa6 | Hash listed for the trojanized Nirsoft tool. |
| SHA256 | 5563599441935e3c0c8bdd42ec2c35b78f8376b6c9560898ef6401531058eb87 | Hash listed for a keylogger. |
| SHA256 | 595be57cb6f025ec5753fbe72222e3f7c02b8cb27b438d48286375adbcf427c6 | Hash listed for the trojanized Nirsoft tool. |
| SHA256 | 5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590 | Hash listed for a campaign implant. |
| SHA256 | 811b42bb169f02d1b0b3527e2ca6c00630bebd676b235cd4e391e9e595f9dfa8 | Hash listed for a campaign maldoc. |
| SHA256 | 85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8 | Hash listed for a campaign implant. |
| SHA256 | 873b8fb97b4b0c6d7992f6af15653295788526def41f337c651dc64e8e4aeebd | Hash listed for a campaign implant. |
| SHA256 | 99b516acd059a4b88f281214d849c5134aa1cea936d69e8eb7393b22be0508a0 | Hash listed for the Stage 2 script. |
| SHA256 | bb0a3c784e55bd25f845644b69c57e3e470af51983617fdfe7ba5d253019ed24 | Hash listed for a campaign implant. |
| SHA256 | c43475601f330a5a17a50f075696e058429656db54cdfcbdccb0fb93446f6ac9 | Hash listed for an information-gathering module. |
| SHA256 | dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f | Hash listed for a keylogger. |
| SHA256 | de0932206c4d531ab4325c0ec8f025108a6807478eb5d744905560ae119fc6fa | Hash listed for an injector. |
| SHA256 | e929f23c242cc102a16f5466163622585455aee7b6ed3f98d12787086b14e721 | Hash listed for an information-gathering module. |
| SHA256 | f4d06956085d2305c19dd78c6d01b06f17ab43e9dd4808885fd08d5da08dd9d2 | Hash listed for a downloader module. |
| URL | hxxp[:]//eucie09111[.]myartsonline[.]com/0502/v[.]php | Malicious URL used by a maldoc and identified as a known Kimsuky IOC. |
| URL | hxxps[:]//bigfile[.]mail[.]naver[.]com/bigfileupload/download?fid=Q9eCpzlTWrd9HqujK6wnFxEXKxKdHqUmKoumaxUdKxumaxgdHqurKqEmaAb9axvjMrMqMoErpo2wFx3SFquXa6MXKqICM6M/FxU/pAtrFoK= | Specific Naver-hosted implant download URL listed as an indicator. |
| URL | hxxps[:]//bigfile[.]mail[.]naver[.]com/bigfileupload/download?fid=Qr+CpzlTWrd9HqKjK6wnFxEXKxKdHqUmKoumaxUdKxumaxgdHqurKqEmaAb9axvjFoFCFzUqKopCKxEXMoElMrpoF6J4KoCoFqEwFxvdF4t= | Specific Naver-hosted implant download URL listed as an indicator. |
| URL | hxxps[:]//bigfile[.]mail[.]naver[.]com/bigfileupload/download?fid=QrFCpzlTWrd9HqUjK6wnFxEXKxKdHqUmKoumaxUdKxumaxgdHqurKqEmaAb9axvjpx3CKxi4K4tdMrp4axioFzpSFzUrFovqpotlpx+SpAv= | Specific Naver-hosted implant download URL listed as an indicator. |
| URL | hxxps[:]//bigfile[.]mail[.]naver[.]com/bigfileupload/download?fid=QrRCpzlTWrd9HqtjK6wnFxEXKxKdHqUmKoumaxUdKxumaxgdHqurKqEmaAb9axvjFxbwFqiSpztXF630pxFCFqM9F6UZaAi4MrFCK4UrKqg= | Specific Naver-hosted implant download URL listed as an indicator. |
MITRE ATT&CK
T1007 · System Service DiscoveryThe instrumentor gathers the names of services running on the infected system.T1012 · Query RegistryThe instrumentor queries a registry value to obtain the Microsoft version number.T1016 · System Network Configuration DiscoveryThe information-gathering implant runs ipconfig and arp to collect network configuration information.T1027 · Obfuscated Files or InformationThe malware uses encoded scripts and payloads, and alters a downloaded DLL's first byte as an evasion measure.T1041 · Exfiltration Over C2 ChannelThe instrumentor uploads archived files and logs to attacker-specified locations over HTTP.T1055.012 · Process HollowingThe file injector places payloads into benign processes such as svchost.exe or iexplore.exe via process hollowing.T1056.001 · KeyloggingA keylogger records keystrokes using GetAsyncKeyState and saves them to a log file.T1057 · Process DiscoveryThe instrumentor and information-gathering implant collect running process names and task lists.T1059.001 · PowerShellA temporary PowerShell script deploys downloaded DLL implants.T1059.003 · Windows Command ShellThe implants use cmd.exe commands for system discovery and file operations.T1059.005 · Visual BasicVBA macros and VBScript stages drop, decode, and execute malware components.T1071.001 · Web ProtocolsThe malware retrieves blog content and sends beacons and exfiltrated data using HTTP requests.T1082 · System Information DiscoveryThe malware collects OS, system, and endpoint information from infected systems.T1083 · File and Directory DiscoveryThe malware enumerates files and searches specified directories and paths for files of interest.T1105 · Ingress Tool TransferVBScript stages retrieve scripts and payloads from attacker-operated blogs and remote URLs.T1140 · Deobfuscate/Decode Files or InformationThe scripts decode base64-encoded VBScript and the implant decodes XOR-encoded payloads.T1218.011 · Rundll32The malware launches deployed DLL implants using rundll32.exe.T1547.001 · Registry Run Keys / Startup FolderStage 2 creates a shortcut in the current user's Startup directory to run Stage 3 at login or restart.T1555.003 · Credentials from Web BrowsersThe trojanized WebBrowserPassView payload extracts browser-stored credentials and writes them to a file.T1560.001 · Archive via UtilityThe scripts package selected files, logs, and stolen credentials into ZIP archives before exfiltration.
People
Threat Actors
Black BansheeThe article identifies this as another name for Kimsuky, which it assesses operated the campaign.KimsukyThe article attributes the campaign to this North Korean state-sponsored APT group; the article also identifies Thallium and Black Banshee as names for Kimsuky.LazarusMentioned as a related group in the discussion of attack-chain characteristics.ThalliumThe article identifies this as another name for Kimsuky, which it assesses operated the campaign.
Malware
AppleseedKimsuky employs a wide variety of malware such as Gold Dragon, Babyshark, Appleseed, etc. Kimsuky primarily targets entities in South Korea ranging from defense, to education and think tanks.BabysharkKimsuky employs a wide variety of malware such as Gold Dragon, Babyshark, Appleseed, etc. Kimsuky primarily targets entities in South Korea ranging from defense, to education and think tanks.Brave PrinceThese implants are derivatives of the Gold Dragon/Brave Prince family of malware operated by Kimsuky since at least 2017 — now forked into three separate modules.Gold DragonThese implants are derivatives of the Gold Dragon/Brave Prince family of malware operated by Kimsuky since at least 2017 — now forked into three separate modules.
Vendors
Products
AHNLAB V3 AntivirusTo start, the implant looks for the AHNLAB V3 Antivirus software’s class name “49B46336-BA4D-4905-9824-D282F05F6576”.BlogspotThis campaign utilizes malicious blogs hosted on Blogspot to deliver three types of preliminary malicious content: beacons, file exfiltrators and implant deployment scripts.Google ChromeThe instrumentor script also performs a cleanup of the cookies for Google Chrome and Microsoft Edge browsers. This activity is performed after the implants are in place to force users to reauthenticate. This is done byMicrosoft EdgeThe instrumentor script also performs a cleanup of the cookies for Google Chrome and Microsoft Edge browsers. This activity is performed after the implants are in place to force users to reauthenticate. This is done byMicrosoft OfficeAs noted in their June 2021 report, this campaign begins with malicious Microsoft Office documents (maldocs) containing macros being delivered to victims.Microsoft WindowsGather the list of all files names listed in the Recent Items folder i.e. “%Appdata%\Microsoft\Windows\Recent”.Microsoft Wordseveral VBA functions registered to trigger if the “Typing replaces selection” property is enabled in Microsoft Word. The VBA functions trigger when the victim types any content into the maldoc. Therefore, to trick
Tools
Countries
ChinaThis campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.North KoreaThis campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.RussiaThis campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.South KoreaThis campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.United StatesThis campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.
Industries
AerospaceKimsuky APT group delivering malware to high-value South Korean targets — namely geopolitical and aerospace research agencies. This campaign has been active since at least June 2021 deploying a constantlyDefenseKimsuky employs a wide variety of malware such as Gold Dragon, Babyshark, Appleseed, etc. Kimsuky primarily targets entities in South Korea ranging from defense, to education and think tanks.EducationKimsuky employs a wide variety of malware such as Gold Dragon, Babyshark, Appleseed, etc. Kimsuky primarily targets entities in South Korea ranging from defense, to education and think tanks.ResearchThis campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.