Phishing Alert: Kimusky Hackers Masquerade as Tax Authority with ‘September Tax Return Due Date’ Email

Phishing alerts describe a campaign attributed to the North Korean threat actor known as Kimsuky, with emails masquerading as notices from the National Tax Service (NTS) about a “September Tax Return Payment Due Notice.” The subject line references the NTS and a payment deadline, and the body invites recipients to view an electronic document; the true sending infrastructure is on the Mail(.ru) network, suggesting a compromised or rented server rather than spoofing at the network layer.

Return-Path and envelope-from fields use schimmel2025@list[.]ru, and sender hostnames include send174.j.mail[.]ru with an IP listed as 95.163.59[.]13; SPF passes for the ru domain, DKIM validates with mail4, and DMARC is set to REJECT. Time‑zone discrepancies show the campaign’s origin, with Naver receiving the email at 16:00:44 UTC on 25 August 2025 while the sender’s server logged dispatch at 19:00:40 +03:00, and Korean time reads 01:00:36 on 26 August 2025.

The campaign uses a personalized query string to embed the recipient’s email address, increasing its effectiveness, and victims are prompted to log in with Naver credentials when clicking the link. According to Wezard4u.tistory[.]com, mitigations include avoiding unsolicited emails, verifying headers, and deploying URL sandboxing and machine‑learning threat detection to flag complex encodings and unusual domain patterns, with ongoing emphasis on user vigilance to defend against credential theft.