Threat actors linked to North Korea have been identified using two new malware strains known as KLogEXE and FPSpy. This activity has been linked to a group known as Kimsuky, also referred to as APT43, ARCHIPELAGO, Black Banshee, and other aliases. Researchers from Palo Alto Networks Unit 42 noted that these new malware strains add to the group’s existing arsenal, showcasing their continuous evolution and growing capabilities.
Kimsuky, also known as the “king of spear phishing,” has been active since at least 2012, specializing in tricking victims into downloading malware through deceptive emails. The new malware strains, KLogEXE and FPSpy, are primarily delivered through spear-phishing attacks. These emails are carefully crafted to entice targets into downloading malicious files, initiating an infection chain upon execution.
KLogEXE functions as a C++ version of the InfoKey keylogger, while FPSpy is a variant of a backdoor previously disclosed by AhnLab. Both malware strains are capable of collecting information on running applications, keystrokes, mouse clicks, system details, and executing additional payloads. Unit 42 researchers identified similarities in the source code of KLogEXE and FPSpy, indicating they likely originate from the same author.
The targets of this campaign by Sparkling Pisces (Kimsuky) appear to be Japanese and South Korean organizations. While the campaign is not widespread, it is considered targeted and handpicked, focusing on specific countries and industries. The researchers emphasize the importance of vigilance and cybersecurity measures to mitigate the risks posed by these evolving malware threats.
Source link