ATIP_2023_Mar_Threat-Trend-Report-on-Kimsuky_20230407.pdf (888 KB)

AhnLab observed reduced Kimsuky activity in March 2023 compared with February, with RandomQuery becoming the most active type ahead of AppleSeed and FlowerPower. FlowerPower began using Korean-language Punycode domains and free Korean hosting domains such as r-e.kr, p-e.kr, o-r.kr, n-e.kr, and kro-kr to appear more trustworthy to Korean victims, including attacks against professors. RandomQuery activity used multiple initial delivery methods, including LNK archives that launched embedded PowerShell, revealed an HWP password as a decoy, and downloaded additional scripts from command-and-control infrastructure. Kimsuky also adopted OneNote delivery, placing malicious scripts over document names, while xRAT was distributed through Google Drive using a macro-enabled Word lure that loaded scripts, performed process hollowing, and used three C2 IP-and-port pairs.