Kimsuky

Kimsuky has registered domains to spoof targeted organizations and trusted third parties.^{[10][11][5][3][4]}

Kimsuky has used FTP to download additional malware to the target machine.^[12]

Kimsuky has used RC4 encryption before exfil.^[13]

Kimsuky has placed scripts in the startup folder for persistence.^[13][5][14]

Kimsuky has executed a variety of PowerShell scripts.^[1][5]

Kimsuky has compromised email accounts to send spearphishing e-mails.^[12][4]

Kimsuky has created new services for persistence.^[13][5]

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers.^[9][5][6]

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.^[5]

Kimsuky has set auto-forward rules on victim's e-mail accounts.^[5]

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.^[13]

Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.^[4]

Kimsuky has been observed turning off Windows Security Center.^[13]

Kimsuky has deleted the exfiltrated data on disk after transmission.^[13]

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.^{[1][13][5][6]}

Kimsuky has disguised services to appear as benign software or related to operating system functions.^[5]

Kimsuky has obtained and used tools such as Mimikatz and PsExec.^[6]

Kimsuky has gathered credentials using Mimikatz and ProcDump.^[5][6]

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.^{[9][13][10][12][3][4]}

Kimsuky has used links in e-mail to steal account information.^[12][4]

Kimsuky has used RDP for direct remote point-and-click access.^[6]

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.^[4]

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.^[5]

Kimsuky has used mshta.exe to run malicious scripts on the system.^[1][5][14]

Kimsuky has signed files with the name EGIS CO,. Ltd..^[10]

Kimsuky has used tools that are capable of obtaining credentials from saved mail.^[6]

Kimsuky has used pass the hash for authentication to remote access software used in C2.^[5]

Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.^{[10][12][5][3][4]}

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.^[6]