National Cyber Warfare Foundation (NCWF) Forums


North Korean Kimusky Group Attacking University Professors


0 user ratings
2024-08-09 12:39:23
milo
Red Team (CNA)

Kimsuky, a North Korean APT group, employs targeted phishing campaigns, leveraging DMARC exploitation to conceal social engineering, infiltrate university networks, and steal research for the Reconnaissance General Bureau.  It aligns with North Korea’s goal of intelligence acquisition to advance its scientific capabilities, mirroring past actions of stealing nuclear, healthcare, and pharmaceutical research.  The recent exposure […]


The post North Korean Kimusky Group Attacking University Professors appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.



Kimsuky, a North Korean APT group, employs targeted phishing campaigns, leveraging DMARC exploitation to conceal social engineering, infiltrate university networks, and steal research for the Reconnaissance General Bureau. 





It aligns with North Korea’s goal of intelligence acquisition to advance its scientific capabilities, mirroring past actions of stealing nuclear, healthcare, and pharmaceutical research. 





The recent exposure of Kimsuky’s OPSEC failures provides critical insights into their operations and reinforces the ongoing threat posed by this cyber espionage group. 





Kimsuky leverages compromised internet hosts, including audko [store], dorray [site], and others, as staging grounds for attacks by deploying a heavily obfuscated webshell dubbed “Green Dinosaur,” derived from Indrajith Mini Shell 2.0, onto these compromised systems.





“Green Dinosaur” webshell



This webshell, stripped of unnecessary functions for evasion, enables remote operators to upload, download, rename, and delete files, facilitating the creation of phishing websites. 





Kimsuky has crafted phishing pages mirroring legitimate university login portals, specifically targeting Dongduk, Korea, and Yonsei universities, which have been modified to capture credentials, bypass standard encryption, and redirect victims to a decoy PDF hosted on Google Drive. 





Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Access





The PDF, disguised as an invitation to the Asan Institute for Policy Studies August Forum, is likely a social engineering tactic to increase victim trust.





Credential theft occurs through a PHP script that logs username, password, and login attempts to a server file.





Screenshot of the j_spring_security_check.php code



It utilizes modified Javascript code to steal login credentials for Korea and Yonsei universities. The attack injects malicious code into legitimate login pages that resemble the real university portals. 





Korea University’s attack alters Javascript to capture user input, while Yonsei University’s attack modifies HTML to achieve the same result. 





Both targets use login.php to receive stolen credentials but ultimately redirect to the genuine login pages to avoid immediate suspicion by leveraging trust in established university portals to trick victims into surrendering their login information.  





Screenshot of the modified Yonsei login page HTML code



Kimsuky employs a generic phishing toolkit to target Naver accounts, which functions as a rudimentary proxy, similar to Evilginx, designed to capture cookies and credentials from unsuspecting victims. 





Once compromised, users are presented with deceptive pop-ups mimicking server communication errors, prompting them to re-enter login details. Upon clicking “OK,” victims are redirected to a fraudulent Naver login page, where their credentials are stolen. 





By leveraging a custom PHPMailer implementation named “SendMail” hosted on GreenDinosaur to distribute phishing emails, the attacker compromised a Seoul National University professor’s email account to access a South Korean SMTP server for Dooray CRM. 





Screenshot of Kimsuky’s malicious popup telling the user to login again due to a server communication error



According to Resilience, these accounts, sharing identical credentials and recovery emails, were exploited to target employees at Dongduk, Korea, and Yonsei Universities, among others. 





Attackers configured a SendMail server to distribute Naver-themed phishing emails using compromised Gmail and Daum accounts.





Malicious emails, such as those claiming Naver account deletion or email restrictions, direct victims to multiple phishing websites.





Download Free Cybersecurity Planning Checklist for SME Leaders (PDF) – Free Download


The post North Korean Kimusky Group Attacking University Professors appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.



Source: gbHackers
Source Link: https://gbhackers.com/north-korean-kimusky-group/


Comments
new comment
Nobody has commented yet. Will you be the first?
 
Forum
Red Team (CNA)



Copyright 2012 through 2024 - National Cyber Warfare Foundation - All rights reserved worldwide.