Kimsuky

Kimsuky has added accounts to specific groups with net localgroup.^[13]

Kimsuky has used HTTP GET and POST requests for C2.^[15]

Kimsuky has used QuickZip to archive stolen files before exfiltration.^[15]

Kimsuky has placed scripts in the startup folder for persistence and modified the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Registry key.^{[17][4][18][15][13]}

Kimsuky has executed a variety of PowerShell scripts including Invoke-Mimikatz.^{[1][4][15][13][5]}

Kimsuky has compromised email accounts to send spearphishing e-mails.^[16][3]

Kimsuky has compromised legitimate sites and used them to distribute malware.^[13][5]

Kimsuky has created accounts with net user.^[13]

Kimsuky has created new services for persistence.^[17][4]

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.^{[10][4][7][15]}

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.^[4][15]

Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.^[13]

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.^[13]

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.^[17]

Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.^[15]

Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.^[3][6]

Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.^[13]

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.^[17][15]

Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.^[17][15][13]

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.^{[1][17][4][7][15][13]}

Kimsuky has disguised services to appear as benign software or related to operating system functions.^[4]

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.^[7][15][5]

Kimsuky has gathered credentials using Mimikatz and ProcDump.^[4][7][13]

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.^{[10][17][11][16][2][3][15][13]}

Kimsuky has used RDP for direct remote point-and-click access.^[7]

Kimsuky has downloaded additional malware with scheduled tasks.^[13]

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.^[3]

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.^[4]

Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct.^[13]

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants.^[15][5]

Kimsuky has signed files with the name EGIS CO,. Ltd..^[11]

Kimsuky has used mshta.exe to run malicious scripts on the system.^{[1][4][18][13]}

Kimsuky has used tools that are capable of obtaining credentials from saved mail.^[7]

Kimsuky has used pass the hash for authentication to remote access software used in C2.^[4]

Kimsuky has lured victims into clicking malicious links.^[13]

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.^[7]

Kimsuky has used Blogspot pages for C2.^[15]