Sara Peters contributed to this reporting.
North Korean APT group Kimsuky is adopting new tactics, techniques, and procedures in global attacks, report researchers whose findings indicate the group's operations have sufficient differences to warrant splitting it into two smaller subgroups: CloudDragon and KimDragon.
Kimsuky is not a new group but has adopted new methods to support its mission of collecting intelligence. A US government alert issued in October 2020 reported the group had been operating since 2012 and often employs social engineering, spear-phishing, and watering hole attacks to collect information from targets primarily located in South Korea, Japan, and the US.
A team of researchers observing North Korean APT groups have collected evidence suggesting there are several significant distinctions in the way different facets of Kimsuky operate. Today at the virtual Black Hat Asia event, Jhih-Lin Kuo and Zin-Cing Lao, both senior threat intelligence researchers at TeamT5, divided the group into two smaller groups based on their targets, malware, and infrastructure, and shared details on how the groups' operations have evolved.
The Kimsuky group that Kaspersky disclosed in 2013 has been dubbed KimDragon by the team; the more publicly known Kimsuky seen in news headlines and vendor reports is CloudDragon.
"There are still some things they share together, but there are differences as well," said Kuo in today's briefing. Both focus on South Korea as their primary target, in addition to the US. Both attack government agencies and educational targets such as universities and research centers.
"However, when we l ..
Support the originator by clicking the read the rest link below.
