Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign

MITRE Techniques

• [T1566.002] Phishing: Spearphishing Link – Spear-phishing emails with OneDrive links to download a document; “The lure email contained the OneDrive shared file link.”
• [T1566.001] Phishing: Spearphishing Attachment – Password-protected document attachment containing a macro; “The file downloaded is a password protected .doc file named “Research Proposal-Haowen Song.doc” (SHA1: 86a025e282495584eabece67e4e2a43dca28e505) which contains a malicious macro (SHA1: c8f54cb73c240a1904030eb36bb2baa7db6aeb01)”.
• [T1059.005] Command and Scripting Interpreter: Visual Basic – Macros embedded in Office documents used to deliver and execute payloads; “The lure documents Kimsuky distributes contain Microsoft Office macros that activate on document close.”
• [T1023] Shortcut Modification – ReconShark edits Windows Shortcuts (LNK files) to launch legitimate browsers and run malicious code; “ReconShark edits Windows Shortcuts (LNK files) to the msedge.exe, chrome.exe, outlook.exe, whale.exe, and firefox.exe applications. When executed, these LNK files start the linked legitimate applications and execute malicious code at the same time.”
• [T1221] Template Injection – Replaces the default Office template (%AppData%MicrosoftTemplatesNormal.dotm) with a malicious template hosted at the C2; “replaces the default %AppData%MicrosoftTemplatesNormal.dotm Office template, which opens whenever a user starts Microsoft Word, with a malicious Office template hosted at the C2 server.”
• [T1105] Ingress Tool Transfer – The malware can directly download a payload from the C2 server; “the malware can directly download a payload from the C2 server using the curl utility.”
• [T1059.003] Windows Command Shell – Deployment via Windows Batch scripts; “Windows Batch scripts” are used as part of the payload chain.
• [T1059.006] VBScript – Deployment via VBScript payloads (VBS); part of the multi-stage approach.
• [T1059.007] HTML Application – Deployment via HTA scripts; “HTA script” used as part of payload execution.
• [T1047] Windows Management Instrumentation – ReconShark uses WMI to query system data; “ReconShark relies on Windows Management Instrumentation (WMI) to query process and battery information.”
• [T1057] Process Discovery – ReconShark enumerates running processes as part of information gathering.
• [T1082] System Information Discovery – Retrieves system information such as battery status to assess host capabilities.
• [T1041] Exfiltration Over C2 Channel – Collected data is uploaded to the C2 server via HTTP POST requests; “uploads them to the C2 server by issuing HTTP POST requests.”
• [T1027] Obfuscated/Compressed Files or Information – Some strings are encrypted with a simple cipher to evade static detection; “strings are encrypted using a relatively simple cipher to evade static detection mechanisms.”
• [T1071.001] Web Protocols – Beacons and C2 communications occur over web protocols to domains like rfa.ink and mitmail.tech; “beacons are made to the /bio/ directory of rfa[.]ink” and similar patterns across C2 domains.