MediumPublished
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer…
By S2W
Excerpt
14 min read
Feb 7, 2024
Author: Jiho Kim & Sebin Lee | BLKSMTH
Last Modified : Feb 7, 2024
Press enter or click to view image in full size
Photo by Mark König on Unsplash
Executive Summary
S2W threat research and intelligence center Talon has hunted for and analyzed a sample of what is believed to be a new malware from the Kimsuky group on VirusTotal.
— The malware was found to be distributed from a page that redirects users to a specific site located in South Korea to download a security program.
— Unlike typical supply chain attacks, only 2 of the 5 installers distributed by the site were modified to include the…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Medium on medium.com.
Mentioned in the excerpt
More from Medium19
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
- Lx(Base) RAT: A Technical Deep DiveMedium · Published 3 Aug
- Reverse Engineering the Auto-Color Linux BackdoorMedium · Published 30 Aug
- 1337_GTWK Linux Malware AnalysisMedium · Published 30 Jul
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
