Kimsuky

Kimsuky has added accounts to specific groups with net localgroup.^[15]

Kimsuky has used HTTP GET and POST requests for C2.^[18]

Kimsuky has used QuickZip to archive stolen files before exfiltration.^[18]

Kimsuky has placed scripts in the startup folder for persistence and modified the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Registry key.^{[21][4][22][18][15]}

Kimsuky has executed a variety of PowerShell scripts including Invoke-Mimikatz.^{[1][4][18][15][5]} Kimsuky has also utilized PowerShell scripts for execution, persistence, and defense evasion.^[19]

Kimsuky has compromised email accounts to send spearphishing e-mails.^[20][3]

Kimsuky has compromised legitimate sites and used them to distribute malware.^[15][5][17]

Kimsuky has created accounts with net user.^[15]

Kimsuky has created new services for persistence.^[21][4]

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.^{[11][4][7][18]}

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.^[4][18]

Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.^[15]

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.^[21]

Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.^[18] Kimsuky has also leveraged Dropbox for uploading victim system information.^[19]

Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.^[3][6][17]

Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.^[15]

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.^[21][18]

Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.^[21][18][15] Kimsuky has deleted files using the Remove-Item PowerShell commandlet to remove traces of executed payloads.^[19]

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.^{[1][21][4][7][18][15]}

Kimsuky has disguised services to appear as benign software or related to operating system functions.^[4][19]

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.^[7][18][5]

Kimsuky has gathered credentials using Mimikatz and ProcDump.^[4][7][15]

Kimsuky has used a modified TeamViewer client as a command and control channel.^[21][22]

Kimsuky has used RDP for direct remote point-and-click access.^[7]

Kimsuky has downloaded additional malware with scheduled tasks.^[15] Kimsuky has established persistence by creating a scheduled task named "ChromeUpdateTaskMachine" through the PowerShell cmdlet Register-ScheduleTask which was set to execute another PowerShell script once, then five minutes after its creation and periodically repeat every 30 minutes.^[19]

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.^[4]

Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct.^[15] Kimsuky has also obtained details on antivirus software through WMI queries using Win32_OperatingSystem and SecurityCenter2.AntiVirusProduct.^[19]

Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.^[11][7]

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants.^[18][5][17] Kimsuky has also hosted malicious payloads on Dropbox.^[19]

Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.^[12][25]

Kimsuky has used mshta.exe to run malicious scripts on the system.^{[1][4][22][15]}

Kimsuky has used tools that are capable of obtaining credentials from saved mail.^[7]

Kimsuky has used pass the hash for authentication to remote access software used in C2.^[4]

Kimsuky has lured victims into clicking malicious links.^[15]

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.^[7]

Kimsuky has used TRANSLATEXT and a dead drop resolver to retrieve configurations and commands from a public blog site.^[23]