ATIP_2023_Jun_Threat-Trend-Report-on-Kimsuky-Group-1.pdf (362 KB)

AhnLab’s June 2023 Kimsuky trend report says observed Kimsuky activity slightly increased in fully qualified domain names, with more AppleSeed-type activity than in May. The report highlights FlowerPower samples that briefly removed an information-collection function before reintroducing it, suggesting testing or detection-evasion changes, and notes that RandomQuery’s attempted transition to a new system had not materially changed since March. Kimsuky tooling continued to be delivered through Word, CHM, OneNote, and more recently .NET EXE files that write Base64-encoded data as update.vbs, display a North Korean-grammar “document corrupted” message, and download additional scripts from C2 infrastructure. The PDF also includes IOC sections for file paths, MD5 hashes, domains, URLs, and IP addresses.