Rewterz Threat Alert – Gh0st RAT – Active IOCs
January 16, 2023Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
January 16, 2023Rewterz Threat Alert – Gh0st RAT – Active IOCs
January 16, 2023Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
January 16, 2023Severity
High
Analysis Summary
Kimsuky – aka Thallium, Black Banshee, Velvet Chollima – is a North Korean nation-state actor that has been active since 2012. It primarily targets South Korean government agencies and conducts espionage activities against targets in the United States and Japan. This group has the ability to put up phishing infrastructure that can effectively imitate well-known websites and fool users into entering their passwords.KISA (Korean Internet & Security Agency) published a full investigation of Kimsuky’s phishing infrastructure and TTPs used to attack South Korea in December 2020. To get Initial Access to victim networks, Kimsuky’s threat actors use a variety of spear phishing and social engineering techniques. This group is responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise, and other major campaigns like Operation Kabar Cobra(2019).
In October 2022, Kimsuky was observed using recently discovered mobile malware to target Android devices. Researchers gave the malicious APKs the names FastFire, FastViewer, and FastSpy by including the word Fast in the package name and describing each one’s characteristics. This group has been conducting constant attacks on mobile devices in order to steal the target’s information. Their sophisticated technique is Firebase, a standard service employed as the C&C server in FastFire. Furthermore, some attempts are being made to avoid detection by modifying Androspy, an open-source RAT. Sophisticated attack vectors, similar to FastViewer, are utilized to attack specified targets, and existing open sources are being leveraged to produce high-performance variations such as FastSpy. FastViewer and FastSpy were actually employed to attack South Koreans and all three APKs. The mobile targeting approach of the Kimsuky group is becoming more advanced, thus it is important to be cautious about sophisticated attacks aimed at Android smartphones or devices.
Impact
- Data Theft and Espionage
- Sensitive Data Exposure
Indicators of Compromise
MD5
- a4605f24de3aba74ccce5d5ab73d67a6
SHA-256
- 4e5ef5933078edeb09fd7d44f90843f4a221c1754d9d15a39aded79416b40779
SHA-1
- 0ad1fd0259c3f1b2976a0b25ede259470666d27d
URL
- http://ielsd.myartsonline.com/kw/on.txt
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.