Kimsuky Threat Group Using Chrome Remote Desktop – ASEC BLOG

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – Users receive spear phishing emails with attachments that masquerade as regular documents to install malware. Quote: “Users who receive spear phishing emails with these malware attachments can open these thinking these are regular document files…”
• [T1059] Command and Scripting Interpreter – The group uses script-type malware and commands (WSF/JS, PowerShell) to execute or decode payloads. Quote: “WSF or JS scripts with files disguised with document file extensions were mostly used in the AppleSeed distribution process.”
• [T1059.001] PowerShell – PowerShell commands are used to decode files during the Dropper execution. Quote: “PowerShell commands to decode files.”
• [T1059.007] JavaScript – JavaScript used as script-type droppers (WSF/JS) for AppleSeed distribution. Quote: “WSF or JS scripts with files disguised with document file extensions were mostly used in the AppleSeed distribution process.”
• [T1218.011] Signed Binary Proxy Execution: Regsvr32 – regsvr32.exe is used to load and execute AppleSeed with specific arguments. Quote: “regsvr32.exe /s /n /i:123qweASDZXC C:Windows..ProgramDatao5C2anK.efgL”
• [T1105] Ingress Tool Transfer – The attacker downloads and installs tools like Ngrok and other payloads via commands issued to AppleSeed. Quote: “Ngrok is installed to enable remote control…”
• [T1021] Remote Services – The actors rely on remote-access services (Chrome Remote Desktop, RDP Wrapper, VNC) to control infected systems. Quote: “The Kimsuky APT group tends to use remote desktop services to obtain control over infected systems.”
• [T1572] Protocol Tunneling – Ngrok tunnels are used to reach remote hosts outside NAT. Quote: “Ngrok has been identified in multiple actual detected cases of attacks.”
• [T1555.003] Credentials from Web Browsers – Infostealer steals credentials from web browsers (Chrome, Edge, Whale) and stores them in local paths. Quote: “Target Web Browsers for Account Credential Theft” and “Path Where Account Credentials Are Stored”.
• [T1071.001] Web Protocols – AppleSeed communicates with its C2 over HTTP. Quote: “HTTP protocol for communication with the C&C server.”