(Kaspersky) For several months, we have been monitoring an ongoing cyber-espionage campaign against South Korean think-tanks. There are multiple reasons why this campaign is extraordinary in its execution and logistics. It all started one day when we encountered a somewhat unsophisticated spy program that communicated with its “master” via a public e-mail server. This approach is rather inherent to many amateur virus-writers and these malware attacks are mostly ignored.
These hackers are using sophisticated reply-baiting tactics, mimicking legitimate events and leveraging publicly available tools, but their methods are relatively basic and easily detectable.
North Korean hackers, tracked as Kimsuky and linked to Operation GitPower, are targeting Ukrainian experts in diplomacy, security, and international policy to gather intelligence on Russia's war efforts and North Korea's…
A North Korean advanced persistent threat (APT) group is suspected of targeting South Korean media and automotive firms since early 2025, utilizing a previously undocumented Linux espionage toolkit called "TED." The atta…
A previously undocumented Linux toolkit, dubbed ‘ted,’ has been discovered embedded within trojanized HAProxy load balancers used by two South Korean organizations. Developed by North Korean state-sponsored actors (likel…
QR code phishing, known as ‘quishing,’ is rapidly becoming a significant threat, bypassing traditional email security filters and leveraging familiarity with QR codes to trick employees into accessing malicious content.…
North Korea's Kimsuky hacking group is building an offline AI infrastructure to bolster its phishing attacks and automate malware development. Security firm Genians discovered this setup, finding tools like Ollama, GPT4A…
A new campaign by North Korean threat actor Kimsuky (APT43) targeted South Korean software vendors in 2025 and 2026, ultimately compromising their customers. The group leveraged social engineering and exploiting remote c…
This report details a concerning trend in malware delivery – the evolution of ClickFix, a technique where users are tricked into running malicious code by hand. Researchers have uncovered a new API-driven approach to gen…
North Korean state-sponsored threat actor Kimsuky has expanded its arsenal and tactics, utilizing HTTPSpy, HelloDoor, and VS Code tunnels to target South Korean military and corporate entities between March and April 202…
ESET’s Q4 2025 – Q1 2026 APT Activity Report highlights a period of intense geopolitical activity driving advanced cyber espionage. China-aligned actors were mobilized to monitor maritime and energy developments, while I…
This report details the ongoing activity of the Kimsuky threat actor group, also known as APT43, who have been utilizing a PebbleDash-based malware platform to conduct targeted attacks. The group has significantly evolve…
