SentinelLabs tracks a targeted social engineering campaign by the North Korean APT group Kimsuky aimed at North Korea affairs experts to steal Google and NK News/NK News Pro credentials and to deliver ReconShark reconnaissance malware. The operation impersonates NK News leadership, uses spoofed nknews.pro URLs, a Google Docs lure, and password-protected Office documents to harvest credentials and gather strategic intelligence.
#Kimsuky #ReconShark #NKNews #NKNewsPro #GoogleDocs
#Kimsuky #ReconShark #NKNews #NKNewsPro #GoogleDocs
Keypoints
- Kimsuky is identified with high confidence as the orchestrator behind a targeted social engineering campaign against North Korea affairs experts.
- The campaign seeks Google and NK News/NK News Pro credentials and deploys ReconShark reconnaissance malware.
-
MITRE Techniques
- [T1566.002] Phishing: Spearphishing Link – The URL’s destination is manipulated through the spoofing technique of setting the href HTML property to direct to a website created by Kimsuky. ‘The URL’s destination is manipulated through the spoofing technique of setting the href HTML property to direct to a website created by Kimsuky.’
- [T1566.001] Phishing: Spearphishing Attachment – Password-protected weaponized Office documents that deploy the ReconShark reconnaissance malware. ‘password-protected weaponized Office documents that deploy the ReconShark reconnaissance malware.’
- [T1056.003] Input Capture – The JavaScript code captures entered credentials by issuing an HTTP POST request to https://www.nknews.pro/ip/register/login.php. ‘The JavaScript code captures entered credentials by issuing an HTTP POST request to https://www.nknews.pro/ip/register/login.php’
- [T1071.001] Web Protocols – ReconShark communicates with a C2 server hosted at staradvertiser.store, using domain and IP references. ‘ReconShark payload hosting endpoint’ / ‘ReconShark C2 server endpoint’ / ‘162.0.209.27’ (C2-related activity).
- [T1566.003] Phishing via Service – The fake NK News login site impersonates NK News and collects credentials via nknews.pro. ‘domain nknews.pro masquerades as the authentic NK News site’.
- [T1027] Data Encoding – The base-64 encoded segment in the URL query resolves to the target’s email address. ‘Base-64 encoded segment … resolves to the target’s email address.’
Indicators of Compromise
- [Domain] nknews.pro – Impersonation domain used for credential theft and login pages
- [Domain] staradvertiser.store – ReconShark hosting/C2 infrastructure
- [IP] 162.0.209.27 – C2/hosting IP associated with ReconShark infrastructure
- [Email] [email protected] – Phishing email sender address
- [Email] [email protected] – Phishing email sender address
- [URL] https://www.nknews.pro – Impersonation site
- [URL] https://www.nknews.pro/ip/register/ – NK News impersonation login page
- [URL] https://www.nknews.pro/ip/register/login.php – Credential theft endpoint
- [URL] https://staradvertiser.store/piece/ca.php – ReconShark payload hosting endpoint
- [URL] https://staradvertiser.store/piece/r.php – ReconShark C2 endpoint
- [Hash] 4150B40C00D8AB2E960AA059159149AF3F9ADA09 – Malicious document (password-protected)
- [Hash] 7514FD9E5667FC5085373704FE2EA959258C7595 – Malicious document
- [Hash] 41E39162AE3A6370B1100BE2B35BB09E2CBE9782 – ReconShark: SHA1 hash