Securonix Threat Research Security Advisory: Analysis of New DEEP#GOSU Attack Campaign Likely Associated with North Korean Kimsuky Targeting Victims with Stealthy Malware

MITRE Techniques

• [T1204.002] User Execution: LNK files – Initial execution via a malicious shortcut file (‘IMG_20240214_0001.pdf.lnk’) that runs embedded PowerShell.
• [T1204.001] User Execution: Malicious Link – The lure presents a PDF to the user to mask the malicious activity (‘When the user clicks the PDF lure (shortcut file) they’re immediately presented with a PDF file’).
• [T1059.001] Command and Scripting Interpreter: PowerShell – Multiple stages use PowerShell to download, decrypt, decompress, and execute payloads (‘the ps.bin file is actually another PowerShell script’).
• [T1059.005] Command and Scripting Interpreter: Visual Basic – VBScript stages download and Execute() remote code from Dropbox (‘The crucial part of this script is the “Execute” statement’).
• [T1102] Web Service – C2 and payload retrieval use Dropbox/Google Docs APIs with OAuth tokens to fetch binaries and scripts (‘download/step2/ps.bin’, ‘r_enc.bin’, ‘info_sc.txt’).
• [T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage – AES-encrypted reconnaissance data is uploaded to Dropbox via POST requests (‘constructs an HTTP POST request to upload encrypted data’).
• [T1219] Remote Access Software – The campaign deploys an open-source C# RAT (TutClient/TutRAT) for remote control (‘the decompressed binary file ends up being an open source RAT … TutClient.exe’).
• [T1573] Encrypted Channel – OAuth and HTTPS communications are used for C2 and uploads to cloud storage (‘uses this token to authorize an upload to Dropbox’).
• [T1047] Windows Management Instrumentation – VBScript includes a WMProc subroutine that uses WMI to execute commands on the system (‘uses WMI to execute commands on the system’).
• [T1053] Scheduled Task/Job – The VBScript schedules tasks to maintain persistence (‘Reg subroutine actually schedules a new task’).
• [T1082] System Information Discovery – PowerShell stages enumerate processes, firewall status, AV products, user profile directories, drives and files (‘The script enumerates the following items: Running processes … Firewall status … Registered antivirus products’).
• [T1083] File and Directory Discovery – Stagers enumerate directories and files across drives and user profiles (‘Directories and files within each accessible drive’).
• [T1115] Clipboard Data – Final PowerShell stage monitors and logs clipboard changes using GetClipboardSequenceNumber and [Windows.Clipboard]::GetText() (‘monitor and log changes in the clipboard content’).
• [T1056.001] Input Capture: Keylogging – Key capture via GetAsyncKeyState and .NET interop to log keystrokes (‘uses functions such as GetAsyncKeyState to monitor the state of individual keys’).
• [T1027] Obfuscated Files or Information – Authors use padding and minimal obfuscation (e.g., long sequence of ‘A’ characters and embedded PDF) to evade detection (‘attached to it after tens of thousands of “A” characters’).
• [T1027.010] Command Obfuscation – Large, complex PowerShell command lines and embedded Base64 strings are used to hide intent (‘length of the command is quite impressive … Base64-encoded string’).
• [T1070.004] Indicator Removal: File Deletion – Shortcut stage cleans up created files after execution (‘All files are then deleted’).
• [T1140] Deobfuscate/Decode Files or Information – Scripts decode Base64 and GZIP payloads to reconstruct executables or scripts (r_enc.bin is ‘From Base64’ and ‘Gunzip’).
• [T1132.001] Data Encoding: Standard Encoding – Use of Base64 encoding and gzipped payloads in multiple stages (‘large Base64 encoded string’, ‘GzExtract’).
• [T1041] Exfiltration Over C2 Channel – Periodic PowerShell backdoor uploads and downloads data via cloud-backed C2 (‘script acts as a tool for periodic communication with a command and control (C2) server via Dropbox’).