Kimsuky APT Is Using Social Engineering and AppleSeed Malware to Spy on South Korea

The Genians Security Center (GSC) published a detailed analysis of a new APT campaign attributed to the North Korea–linked group Kimsuky, which is tied to the AppleSeed malware family and targets defence, activist, and North Korea–related communities in South Korea.

According to the report, the campaign ran between March and April 2025 and used a three‑stage approach via Facebook, email and Telegram to establish trust and deliver the AppleSeed backdoor disguised as a file named “Defector Volunteer Support[.]jse.” The attackers employed fake accounts, including one called “Transitional Justice Mission,” and shared malicious files in password‑protected EGG archives to bypass mobile platforms, with follow‑up payloads delivered by asking for personal email addresses.

GSC notes that the malicious files were structurally identical and used a defector‑themed narrative to deceive recipients, while the C2 communications relied on the domain woana.n-e[.]kr for data exchange. The AppleSeed malware is described as a remote access trojan executed through a DLL loaded via regsvr32, capable of collecting system information, receiving commands from the C2 server, and exfiltrating data under a PDF disguise.