Kimsuky Threat Research Report-2

From Reconnaissance

to Control

APT The Operational Blueprint of Kimsuky

for Cyber Espionage

Varadharajan Krishnasamy and Aditya K Sood

www.aryaka.com

From Reconnaissance to Control: The Operational Blueprint of Kimsuky APT for Cyber Espionage - Report 2 Ta

bl

e

of

C

on

te

nt

s

Executive Summary

Introduction

The Geopolitical Context of Cyber-Espionage

What is Kimsuky?

Dissecting the Technical Details

Deception via Lure Document

Verify the State of Deployed Endpoint Protection

One-Time Dynamic Execution

Anti-VM Check and Cleanup Routine

Persistence

Discovery and Data Staging Strategies

Victim Profiling

Harvestin…