GoldDragon campaign: North-Korea linked Kimsuky APT adopts victim verification technique

The North Korea-linked Kimsuky APT is behind a new campaign, tracked as GoldDragon, targeting political and diplomatic entities in South Korea in early 2022.

Researchers from Kaspersky attribute a series of attacks, tracked as GoldDragon, against political and diplomatic entities located in South Korea in early 2022 to the North Korea-linked group Kimsuky.

Kimsuky cyberespiona group (aka Black Banshee, Thallium, Velvet Chollima) was first spotted by Kaspersky researcher in 2013. At the end of October 2020, the US-CERT published a report on Kimusky’s recent activities that provided information on their TTPs and infrastructure.

The APT group mainly targets think tanks and organizations in South Korea, other victims were in the United States, Europe, and Russia.

The GoldDragon campaign targets the media and a think-tank in South Korea, the attack chain starts sending a spear-phishing email with a weaponized Word document.

The final stage is an info-stealing Windows malware that is able to steal stored web browser credentials and user keystrokes.

“The actor took advantage of the HTML Application file format to infect the victim and occasionally used the Hangeul decoy document. After the initial infection, a Visual Basic Script was delivered to the victim. In this process, the actor abused a legitimate blog service to host a malicious script with an encoded format. The implanted VBS file is capable of reporting information about infected machines and downloading additional payloads with an encoded format.” reads the report from Kaspersky. “The final stage is a Windows executable-type malware that is capable of stealing information from the victim such as file lists, user keystrokes, and stored web browser login credentials.”

Threat actors also take advantage of HTML Application (HTA) and Compiled HTML Help (CHM) files as bait documents.

Once obtained the initial access to the target system, the attackers drop a Visual Basic Script that is fetched from a remote server. The script allows to fingerprint the machine and retrieve additional malicious payloads.

The APT group configured multi-stage C2 servers with various commercial hosting services located around the world. 

The first stage C2 server verifies the incoming email address parameter is an expected one and only delivers the malicious document to specific addresses.

“The first stage C2 server verifies the incoming email address parameter is an expected one and delivers the malicious document if it’s in the target list. The first stage script also forwards the victim’s IP address to the next stage server.” continues the report. “When the fetched document is opened, it connects to the second C2 server. The corresponding script on the second C2 server checks the IP address forwarded from the first stage server to check it’s an expected request from the same victim. Using this IP validation scheme, the actor verifies whether the incoming request is from the victim or not. On top of that, the operator relies on several other processes to carefully deliver the next payload such as checking OS type and predefined user-agent strings.”

“The main difficulty in tracking this group is that it’s tough to acquire a full-infection chain. As we can see from this research, threat actors have recently adopted victim verification methodology in their command and control servers.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Kimsuky)