North Korean Hackers Change Tactics, Impersonate Researchers

Diving into details

• The campaign first started in January and has proven to be very successful since the process of intel gathering has changed. 
• In certain cases, the attackers even engage with the target for months to gain all the relevant information. They use spoofed emails impersonating research institutes.

Why this matters

• It is more efficient and quicker to gather information from some sources using this technique as compared to launching spear-phishing campaigns, building malware, and traversing through compromised email accounts for the right intelligence. 
• Kimsuky got the information directly from the experts, eliminating the need for making interpretations. 
• Microsoft stated that the threat actor also engages with the experts without ever sending any malicious links or files even after they respond. 
• This technique help them evade detection by security solutions that would scan and flag the malware warning.

What has Kimsuky been up to?

• Thallium was last observed in October in a new cyberespionage campaign targeting Android devices in South Korea. 
• It had used three Android malware, dubbed FastFire, FastViewer, and FastSpy, which paraded as APKs for three utility tools. 
• Kimsuky had, previously to the above, launched another cyberespionage campaign against South Korean think tanks, professors, and government entities.

The bottom line