VORANT. Threat Intelligence Research Sign in Create a free account

Kimsuky North Korean APT global intelligence targeting

routine threat government-nationaldefensefinancial-servicestechnology

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Kimsuky APT conducts spearphishing and watering hole attacks to steal intelligence on Korean peninsula policy, nuclear programs, and sanctions.

This CISA/FBI/CNMF joint advisory profiles Kimsuky, a North Korean APT group operating since 2012 under the HIDDEN COBRA program. The group conducts global intelligence collection against South Korea, Japan, and the United States, focusing on foreign policy, national security, nuclear policy, and sanctions related to the Korean peninsula. Kimsuky primarily uses spearphishing with malicious attachments and social engineering to gain initial access, often impersonating reporters or posing as legitimate services to build trust before delivering malware. Once on target, the group deploys BabyShark malware—a VBS-based payload that establishes persistence via registry autostart, collects system information, and awaits C2 commands. Kimsuky employs well-known tools including modified TeamViewer for C&C, PowerShell for fileless execution, ProcDump for credential dumping, and custom keyloggers. The group disables Windows Firewall, abuses legitimate browser extensions for cookie/password theft, injects malicious code into explorer.exe, and exfiltrates data via email forwarding rules or RC4-encrypted channels. Targets include think tanks, foreign policy organizations, and cryptocurrency industry workers. No destructive activity has been observed; the intent is intelligence collection rather than network disruption.

Mentioned in this report

Threat actors Kimsuky
Malware BabySharkGREASEMECHANICAL
Campaigns :STOLEN PENCIL

Detection guidance

Mshta or Script Host Spawned by Office Application

ATT&CK T1218.005

Office applications spawning mshta, wscript or cscript, consistent with spearphishing attachments delivering VBS/HTA payloads such as BabyShark. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mshta or Script Host Spawned by Office Application
description: Detects Office processes launching mshta.exe, wscript.exe or cscript.exe,
  matching spearphishing attachment execution of VBS/HTA payloads like BabyShark.
tags:
- attack.execution
- attack.t1218.005
- attack.t1059.005
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Legacy Office macros or add-ins that invoke VBScript helpers
- Line-of-business document templates launching scripts
level: high
id: 6852ebb3-4d5e-5709-987e-2e062dc5ad38
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a

ProcDump Used to Dump LSASS Memory

ATT&CK T1003

Detects procdump targeting lsass for credential dumping, a tool reported in Kimsuky operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ProcDump Used to Dump LSASS Memory
description: Detects procdump or procdump64 invoked against lsass, matching Kimsuky
  use of ProcDump for credential dumping. Matches on the lsass argument and not on
  dump file names.
tags:
- attack.credential-access
- attack.t1003
- attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith:
    - \procdump.exe
    - \procdump64.exe
  - OriginalFileName: procdump
  selection_cli:
    CommandLine|contains:
    - lsass
  condition: selection_img and selection_cli
falsepositives:
- Administrators capturing LSASS dumps for crash troubleshooting with vendor support
level: high
id: ec67afa4-3e33-59d3-adad-4f69a34977f2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs