Rewterz Threat Alert – Kimsuky APT Group – Active IOCs

February 9, 2022

Severity

High

Analysis Summary

Kimsuky is a North Korean threat actor active since 2012. It primarily targets South Korean government agencies and conducts espionage activities against targets in the United States and Japan. This group has the ability to put up phishing infrastructure that can effectively imitate well-known websites and fool users into entering their passwords. Kimsuky APT is also known by the names Thallium, Black Banshee, and Velvet Chollima. KISA (Korean Internet & Security Agency) published a full investigation of Kimsuky’s phishing infrastructure and TTPs used to attack South Korea in December 2020. To get Initial Access to victim networks, Kimsuky’s threat actors use a variety of spear phishing and social engineering techniques. This group is responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise, and other major campaigns like Operation Kabar Cobra(2019).

Impact

Information theft and espionage
Exposure of sensitive data

Indicators of Compromise

Domain Name

sk5621[.]com[.]co

IP

45[.]77[.]71[.]50

MD5

070f0390aad17883cc8fad2dc8bc81ba
b841d27fb7fee74142be38cee917eda5

SHA-256

d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec
c9375595b2fc63c2d59c4b3f7c1956d514edff24964bceafebe62be94e0bda4c

SHA-1

e9d750a3e2082fd0475decde25096fa1d477d086
82c0e1ca6aa6fd04f7c769e914d7704e25034f82

URL

http[:]//45[.]77[.]71[.]50[:]8082

Remediation

Always be suspicious about emails sent by unknown senders.
Never click on links/attachments sent by unknown senders.
Block all threat indicators at your respective controls.
Search for IOCs in your environment.