ASEC20REPORT_vol.98.pdf (8 MB)

AhnLab's Operation Ghost Union report profiles Kimsuky activity against South Korean institutions and companies. The report says Kimsuky, active since at least 2013, has expanded targeting from military-related areas into political, economic, and social sectors while continuing information-theft operations. AhnLab found that in a December 2019 South Korea-focused attack, Kimsuky used malware associated with Andariel as part of its delivery chain, making the campaign notable for combining Kimsuky-built malware with tooling from another North Korea-linked group.