Kimsuky, a North Korea–backed APT group, relies on phishing and social engineering to steal credentials and gain mailbox access. They build trust with victims through multiple email exchanges, spoofed domains, and permissive DMARC exploitation, and have also used Facebook for phishing. Payloads include LNK, CHM, and MSC files with obfuscated PowerShell, JavaScript, and VBScript for in-memory execution. Malware families like BabyShark, AppleSeed, and AlphaSeed enable data theft and remote access. Persistence is achieved via run keys, services, and scheduled tasks. Despite modest technical skill, Kimsuky’s adaptability and social engineering make them a persistent global threat.

Join for free to read