North Korean hacking group Kimsuky has evolved its espionage tactics by using Facebook for initial infiltration, creating fake profiles to target individuals involved in North Korean human rights and security affairs. The group also uses Microsoft Management Console (MMC) files disguised as ordinary documents to execute malicious commands and establish a C2 channel. #Kimsuky #Facebook #MMC #MicrosoftManagementConsole #Genians
Keypoints
- The attackers create fake Facebook profiles that mimic honest South Korean public officials, engaging with potential targets through friend requests and personal messages.
- The deception aims to build trust and lure victims into a trap by sharing malicious links or documents.
- MMC files (.msc) are crafted to appear as legitimate Word documents and are used to trigger malicious actions on the victim’s system.
- Once executed, the embedded code can allow attackers to gain control or exfiltrate data, with a C2 channel established for remote management.
MITRE Techniques
- [T1566.001] Phishing via Service – The attackers create fake Facebook profiles that mimic honest South Korean public officials, engaging with potential targets through friend requests and personal messages. ‘The attackers create fake Facebook profiles that mimic honest South Korean public officials, engaging with potential targets through friend requests and personal messages.’
- [T1566.002] Spearphishing Link – The deceptive strategy involves using these Facebook accounts to initiate conversations and eventually share malicious links or documents. ‘The deceptive strategy involves using these Facebook accounts to initiate conversations and eventually share malicious links or documents.’
- [T1036] Masquerading – The MMC files are configured to appear as regular Word documents, with icons and metadata that mimic legitimate files. ‘The MMC files are configured to appear as regular Word documents, with icons and metadata that mimic legitimate files.’
- [T1071.001] Web Protocols – The C2 servers are masked to evade detection and orchestrate data collection from the infected machines. ‘C2 servers are often masked to evade detection and orchestrate data collection from the infected machines.’
Indicators of Compromise
- [MD5] Hashes of suspicious files – 56fa059cf7dc562ce0346b943e8f58bb, 1dd007b44034bb3ce127b553873171e5
- [IP] C2 addresses – 52.177.14[.]24 [US], 69.163.180[.]70 [US]
- [Domain/URL] C2 domains – brandwizer.co[.]in/green_pad/wp-content/plugins/custom-post-type-maker/essay/share, yonsei[.]lol
- [File] Documents named or hosted for C2/delivery – share.docx, VOA_Korea.docx
Read more: https://gbhackers.com/north-korean-hackers-abusing/