March 2023 Threat Trend Report on Kimsuky Group
Contents
AhnLab Cyber Threat Intelligence Report
TLP: GREEN
March 2023 Threat Trend Report
on Kimsuky Group
V1.0
AhnLab Security Emergency response Center (ASEC)
Apr. 07, 2023
March 2023 Threat Trend Report on Kimsuky Group
Classification
Publications or provided content can only be used within the scope allowed for each
classification as shown below.
Classification
TLP: RED
TLP: AMBER
TLP: GREEN
TLP: WHITE
Distribution Targets
Precautions
Documents that can only be accessed by
Reports only provided for
the recipient or the recipient department
certain clients and
Cannot be copied or distributed except by
tenants
the recipient
Can be copied and distributed within the
recipient organization (company) of
Reports only provided for
reports
limited clients and
Must seek permission from AhnLab to use
tenants
the report outside the organization, such as
for educational purposes
Can be freely used within the industry and
utilized as educational materials for
Reports that can be used
internal training, occupational training, and
by anyone within the
security manager training
service
Strictly limited from being used as
presentation materials for the public
Cite source
Available for commercial and nonReports that can be
commercial uses
freely used
Can produce derivative works by changing
the content
2
March 2023 …
TLP: GREEN
March 2023 Threat Trend Report
on Kimsuky Group
V1.0
AhnLab Security Emergency response Center (ASEC)
Apr. 07, 2023
March 2023 Threat Trend Report on Kimsuky Group
Classification
Publications or provided content can only be used within the scope allowed for each
classification as shown below.
Classification
TLP: RED
TLP: AMBER
TLP: GREEN
TLP: WHITE
Distribution Targets
Precautions
Documents that can only be accessed by
Reports only provided for
the recipient or the recipient department
certain clients and
Cannot be copied or distributed except by
tenants
the recipient
Can be copied and distributed within the
recipient organization (company) of
Reports only provided for
reports
limited clients and
Must seek permission from AhnLab to use
tenants
the report outside the organization, such as
for educational purposes
Can be freely used within the industry and
utilized as educational materials for
Reports that can be used
internal training, occupational training, and
by anyone within the
security manager training
service
Strictly limited from being used as
presentation materials for the public
Cite source
Available for commercial and nonReports that can be
commercial uses
freely used
Can produce derivative works by changing
the content
2
March 2023 …
IoC
02B6FA59F889CABF36A7CA2A69A7BE86
05E9F932BF0BBA8ED0C12194E89EC899
071F39B1884D2214204AA3D61A170C3E
0A6F0D8A277D93303B1D2D8AFB2D3323
0F7CC24438E0AD3815B19C0C031D87F9
1.234.41.14
108.62.118.0
115.21.139.222
121.160.252.1
169.254.100.95
211.115.73.132
249E111AD3AA659B89E14147F708812C
283D238D309667734D0E5DC33EE7E647
2C69D81CA8D01F082AE2489E3975A0A2
313D77CAAA199188530B15D5BF59A51F
3332170EE3C8DF42DF9AD656D0D0038C
3C687FB0A1921A53F9C607938F25FDD1
3CB38651ABFFD4624E3A2983B886D869
3CE601BF7FEFDD325E596CCB4AACAF93
3E167BE30E343C723FCC42B6F763DE69
4103D0B42DD6230DC1062156356F1D9B
46C7C3D128BE033D92A7AE75464ADE79
47.103.206.233
4A977D0C8B3D9EAA644A3AE93F3D224F
56E9F5CCEBD7252E695B74A9ADA18C6F
5939BB4CB87344EB0BDBF0EBBC998D8A
610DEA8394F486102FC51A2F0560B28A
63B3B94CD606B5C3BE5F5B40A9781CA5
66A249025AB5E39DEBCB1C141EF1FD25
67FC30944A5DB08DEFA3A5D09F731746
6C67341B2873EF27BDBFE3E2AD0A8B56
6FE432E9D8C70391E9B6CD3E074B0760
726AF41024D06DF195784AE88F2849E4
7903D922E89D872C9F2C00C7A10FEF3D
7D40FD8E68A5B0F0125D9711FB26B6A3
804371C4A0DD4FD8ABA732D202F140AB
858907D12008A093E40C501D892A5E90
86028BBAD6C09F8697D2F5DA87D5FD06
864D6E847D3034C01901D378C59DFF93
8A8AB44759D17B9058168E69274389C1
8F411A46490016AC5D126B83CEE65022
923E117DE7B4C115C97410BABC104240
93476273CE03DA710D25DE7DA1924603
93BC23B9E082C97EDD8F78D76672BB0D
954B021E7CC0FF404BDBD57A26509A61
976F6BB98E116DA2BFD8F283058BCD14
9D8C438B710B314B2DC2E003B2F177B7
9E3D8F0B174F717F0291DAAB6FD090AA
AA756B20170AA0869D6F5D5B5F1B7C37
AC999462B9A7B1A81307B5386ADB9128
ACA61A168D95C5F72B8E02650F727000
ACE6CA3FBC585C4EBB67DADCCB79980E
B0D7FF7323A0A2CCD0424FAC906F0BE0
B7C2A9774BD25B36F89417A7BB4BB3D2
C623DBE17F278FD3A72C5681102A74D8
D382CC7F10FDAEC150184941B68CF39E
D4BB07F5A9462612CD0E8A9290E27FC8
D68D3782A74E471F27D6AD18BFB8EAAA
D8C1ABFB0A0B34E4338AD8DFBD6D95FA
DA33F76DE05AA4A97BDA5A91D7272F28
DED83A6BD7438B34B058F2FE5EE54C7E
E0CF0881DE0FE35732BB02C1F4DF02A3
E17B91341EA079D23E9703E55D37DD44
EF3211C7567FA7A5B8944D7BEEEF2869
F2A0E92B80928830704A00C91DF87644
http://dhct.co.kr/mobile/skin/visit/basic/goal/lib.php?idx=[RandomNumber
http://dhct.co.kr/mobile/skin/visit/basic/goal/list.php?query=[RandomNumber
http://eum-it.co.kr/gnuboard4/bbs/img/upload1/lib.php?idx=[RandomNumber
http://eum-it.co.kr/gnuboard4/bbs/img/upload1/list.php?query=[RandomNumber
http://haebyeong.com/modules/trash/conf/demo.txt
http://ibsq.co.kr/config/demo.txt
http://okas.kr/gnuboard4/adm/aaa.dat
http://partybbq.co.kr/src/bbs/img/cop/updown/lib.php?idx=[RandomNumber
http://partybbq.co.kr/src/bbs/img/cop/updown/list.php?query=[RandomNumber
http://partybbq.co.kr/src/bbs/img/goal/updown/lib.php?idx=[RandomNumber
http://partybbq.co.kr/src/bbs/img/goal/updown/list.php?query=[RandomNumber
http://uljincablecar.com/mobile/skin/member/basic/download/lib.php?idx=[RandomNumber
http://uljincablecar.com/mobile/skin/member/basic/download/list.php?query=[RandomNumber
05E9F932BF0BBA8ED0C12194E89EC899
071F39B1884D2214204AA3D61A170C3E
0A6F0D8A277D93303B1D2D8AFB2D3323
0F7CC24438E0AD3815B19C0C031D87F9
1.234.41.14
108.62.118.0
115.21.139.222
121.160.252.1
169.254.100.95
211.115.73.132
249E111AD3AA659B89E14147F708812C
283D238D309667734D0E5DC33EE7E647
2C69D81CA8D01F082AE2489E3975A0A2
313D77CAAA199188530B15D5BF59A51F
3332170EE3C8DF42DF9AD656D0D0038C
3C687FB0A1921A53F9C607938F25FDD1
3CB38651ABFFD4624E3A2983B886D869
3CE601BF7FEFDD325E596CCB4AACAF93
3E167BE30E343C723FCC42B6F763DE69
4103D0B42DD6230DC1062156356F1D9B
46C7C3D128BE033D92A7AE75464ADE79
47.103.206.233
4A977D0C8B3D9EAA644A3AE93F3D224F
56E9F5CCEBD7252E695B74A9ADA18C6F
5939BB4CB87344EB0BDBF0EBBC998D8A
610DEA8394F486102FC51A2F0560B28A
63B3B94CD606B5C3BE5F5B40A9781CA5
66A249025AB5E39DEBCB1C141EF1FD25
67FC30944A5DB08DEFA3A5D09F731746
6C67341B2873EF27BDBFE3E2AD0A8B56
6FE432E9D8C70391E9B6CD3E074B0760
726AF41024D06DF195784AE88F2849E4
7903D922E89D872C9F2C00C7A10FEF3D
7D40FD8E68A5B0F0125D9711FB26B6A3
804371C4A0DD4FD8ABA732D202F140AB
858907D12008A093E40C501D892A5E90
86028BBAD6C09F8697D2F5DA87D5FD06
864D6E847D3034C01901D378C59DFF93
8A8AB44759D17B9058168E69274389C1
8F411A46490016AC5D126B83CEE65022
923E117DE7B4C115C97410BABC104240
93476273CE03DA710D25DE7DA1924603
93BC23B9E082C97EDD8F78D76672BB0D
954B021E7CC0FF404BDBD57A26509A61
976F6BB98E116DA2BFD8F283058BCD14
9D8C438B710B314B2DC2E003B2F177B7
9E3D8F0B174F717F0291DAAB6FD090AA
AA756B20170AA0869D6F5D5B5F1B7C37
AC999462B9A7B1A81307B5386ADB9128
ACA61A168D95C5F72B8E02650F727000
ACE6CA3FBC585C4EBB67DADCCB79980E
B0D7FF7323A0A2CCD0424FAC906F0BE0
B7C2A9774BD25B36F89417A7BB4BB3D2
C623DBE17F278FD3A72C5681102A74D8
D382CC7F10FDAEC150184941B68CF39E
D4BB07F5A9462612CD0E8A9290E27FC8
D68D3782A74E471F27D6AD18BFB8EAAA
D8C1ABFB0A0B34E4338AD8DFBD6D95FA
DA33F76DE05AA4A97BDA5A91D7272F28
DED83A6BD7438B34B058F2FE5EE54C7E
E0CF0881DE0FE35732BB02C1F4DF02A3
E17B91341EA079D23E9703E55D37DD44
EF3211C7567FA7A5B8944D7BEEEF2869
F2A0E92B80928830704A00C91DF87644
http://dhct.co.kr/mobile/skin/visit/basic/goal/lib.php?idx=[RandomNumber
http://dhct.co.kr/mobile/skin/visit/basic/goal/list.php?query=[RandomNumber
http://eum-it.co.kr/gnuboard4/bbs/img/upload1/lib.php?idx=[RandomNumber
http://eum-it.co.kr/gnuboard4/bbs/img/upload1/list.php?query=[RandomNumber
http://haebyeong.com/modules/trash/conf/demo.txt
http://ibsq.co.kr/config/demo.txt
http://okas.kr/gnuboard4/adm/aaa.dat
http://partybbq.co.kr/src/bbs/img/cop/updown/lib.php?idx=[RandomNumber
http://partybbq.co.kr/src/bbs/img/cop/updown/list.php?query=[RandomNumber
http://partybbq.co.kr/src/bbs/img/goal/updown/lib.php?idx=[RandomNumber
http://partybbq.co.kr/src/bbs/img/goal/updown/list.php?query=[RandomNumber
http://uljincablecar.com/mobile/skin/member/basic/download/lib.php?idx=[RandomNumber
http://uljincablecar.com/mobile/skin/member/basic/download/list.php?query=[RandomNumber