W H I T E PA P E R

Kimsuky’s Phishing andPayload Tactics
Matthew Green - Principal Threat Analyst
Natalie Zargarov - Senior Security Researcher
Anna Širokova - Security Researcher, Threat Analytics

Contents

Executive Summary

3

Delivery

4Payloads

7

Conclusion

16

References

172

Executive Summary
The purpose of this white paper is to detail the tactics of the APT Group known as
Kimsuky. In particular, it details their capabilities related to targeting organizations,and their payload tactics. Within this paper we will outline the lures used in active
campaigns, as well as emerging payload tactics that we have observed. All TTPs
detailed within this white paper are incorporated into detection coverage acrossthe Rapid7 portfolio, as detailed within the final section.
Kimsuky operates under the administrative control of a unit within North Korea’s
Reconnaissance General Bureau (RGB). The RGB oversees this network of cyber
operatives and their activities. The data stolen by Kimsuky is shared with otherNorth Korean cyber actors to further the RGB’s objectives.[source]
Kimsuky is an extremely active threat actor that historically has targeted government,
industry, academics and think tanks supporting the interests of the Democratic
People’s Republic of Korea (DPRK). Despite revealing only moderate technicalcapabilities, Kimsuky excels in social engineering, often developing complex
personas and cover identities to help phish their victims.
Kimsuky’s primary objective is credential theft and mailbox access. They havebeen known to phish directly for credentials and use a wide but unsophisticatedvariety of malware to support their objectives.

3

Delivery
Rapid7 has observed email as the most active delivery technique used by Kimsuky.
This group is recognized for its advanced social engineering tactics. A notabletactic of Kimsuky is their extensive efforts to construct backstories during phishingactivities. They typically send multiple emails and mimic routine correspondence
to build trust before attempting to phish the target. Once normal communication
patterns are established, such as during a request for information or meeting, it’svery easy to slip a phish into the conversation thread. Imposing time constraints
or including supporting documents further help to lower a target’s guard, making
them more susceptible to interactions with otherwise untrustworthy sources.
It’s worth noting, Kimsuky has recently been observed executing the same phishingmethodology over Facebook. This highlights the success of the trust building
approach and opens up potential use on other social media platforms.

Figure 1 - Typical Kimsuky attack chain with multiple contact exchanges before delivery

Industry reporting has also noted technical capabilities like Domain-based Message
Authentication, Reporting, and Conformance (DMARC) spoofing. DMARC is anemail authentication protocol that uses previously established standards, Sender
Policy Framework (SPF) and DomainKeys Identified Mail (DKIM), employing DNS
TXT records and key exchanges to validate senders.
A permissive DMARC policy allows spoofed emails to bypass security checks.
Proofpoint reports, since late 2023, many organizations spoofed by Kimsuky either
did not enable or enforce DMARC policies. Kimsuky exploits this by modifying theemail header to display the sender as the spoofed organization and uses free email
addresses, spoofing the same persona in the reply-to field to maintain continuity.

4

Additionally, as Kimsuky regularly targets the academic industry, who may haveseveral placements across institutions, the personal email of a target may bedirectly targeted within an email chain. This approach enables a higher yieldfrom a target that may have multiple aligned work email accounts forwarded toa personal account.
Rapid7 research indicates that email-based attack chains typically employ credential
phish or container-based payloads. Payloads are hosted in public storage with apassword to bypass email security controls or on Kimsuky infrastructure withwebmail spoof with password to access. The payloads often involve a LNK or
CHM file, with a second stage either embedded and/or downloaded from a publicly
accessible location.
Notably, during research Rapid7 also observed public share of a phishing toolthat has been attributed to Kimsuky. Named “Mail Sending Program ver10.0(2022.08.17),” it contains high quality features, modular configuration and attack
method options. This tool highlights the maturity of Kimsuky phishing capabilities
revealing the group’s ability to scale.

Figure 2 - MailSending.exe - Mail sending program ver10.0 (2022.08.17) translated from
Korean (credit: @asdasd13asbz)

5

Lures / Targeting
Historically, Kimsuky has focused its targeting on government, research andthink tanks focused on nuclear policy, or geopolitics connected to North Koreaninterests. As you would expect, this is heavy with targeting South Korean entities.
However, we have observed operations targeting the United States, Japan, andvarious European countries, aiming at think tanks, academic institutions, and othersectors of strategic interest to the DPRK.
Rapid7 observed Kimsuky lures indicating targeting both work and personal livesof its targets. Some recent examples include:• Payments• Crypto regulations• Happy New Year messages• Trusted Installers with signed binary• Foreign Embassy of the Republic of Korea (in China)• Nuclear strategy• Impersonating the South Korean National Tax Service• Import declarations• Corporate promotional material• Job descriptions

Figure 3 - Translation of Kimsuky phish email

6In the example above, Kimsuky targeted the South Korean Embassy in China.
After several emails in the thread discussing a meeting, the payload was sent as
a password protected archive (.rar) hosted in Google Drive. In this case the LNK
payload was hidden as a Hangul word processor file with a double extension.

Figure 4 - RAR contents - LNK file with double extension and HWP icon file

Payloads
LNKs everywhere
During our research Rapid7 observed the use of several different versions of LNK
file payloads built from a variant of a LNK builder proof of concept (POC). Current
versions download a next stage via a public hosted application — Dropbox API for
execution in memory after decryption.
During forensic analysis the biggest standout was the description field: StringData.
NAME_STRING. This field typically stores generic single line descriptions of the LNKor program being executed. Rapid7 noted a unique multiline string that appears to
be a toolmark across LNK payloads:
Type: Text Document
Size: 5.23 KB
Date modified: 01/02/2020 11:23
Another standout item is the leading space in arguments. This is to exploit tools
or analysis that have limited character limits and overlook commands later in thecharacter count.
Similarly, IconLocation field is typically a small character filename with the extensionof the lure used. This is an old trick, that combined with double extension may
deceive the user into thinking they are clicking on a specific file type.

7

Figure 5 - Most recent Kimsuky LNK format

Rapid7 tracked this toolmark to a now removed post by @x86matthew sharing a
POC named EmbedExeLnk. This post was shared in 2022, several months before
the first Kimsuky variant and it’s easy to see similarities like -bxor 0x77 and otherPowerShell commands in the earlier and open source versions. Rapid7 notes
attribution on this toolmark alone is not satisfactory for attribution as there areseveral other examples of LNK building tools based on @x86matthew’s POC.
However, combined with targeting, deployed payloads, and observed infrastructure
we have high confidence that Kimsuky is actively using a LNK builder capability.

Figure 6 - Base64 encoded variant

8

Rapid7 also observed a recent version with an embedded payload that uses
PowerShell to extract to %temp% before execution. Similarly, a previous versionof Kimsuky LNK payloads uses the same embedded payload method of extraction
with heavily obfuscated PowerShell substitution.

Figure 7 - Heavily obfuscated embedded payload variant

Rapid7 observed several techniques to bypass lazy signatures or tooling limitations:• Move towards in-memory execution to limit dropping malware binaries on disk
• Obfuscating with PowerShell cmd ^ ticks: These will not execute directly inPowerShell, but are stripped with the cmd.exe stage of the process tree.

• The more common leading space in arguments and less common logical OR“||“ with a junk string method: Both of these techniques may exploit tools or
analysis that have limited character limits and overlook commands later in thecharacter count.

9

Figure 8 - Embedded payload, version 1

CHMs: Old but new
Rapid7 Labs recently uncovered a suspected new Kimsuky technique using Compiled
HTML Help (CHM) files. CHM is a now depreciated file format that was used fordelivering help documentation in Windows environments. CHM can be exploited dueto their capability to contain and execute HTML and JavaScript code, and embed
automatic execution into the lure document. Similarly to LNK payloads, Rapid7
has observed several campaigns with CHM files. For a more comprehensive lookat this example, please see “The Updated APT Playbook: Tales from the Kimsuky
Threat Actor Group.”

MSC: The next method?
Kimsuky has also recently been publicly reported developing .msc files as payloads.
This filetype is associated with Microsoft Management Console - MMC.exe. MMC
can be used to create and open administrative consoles to manage the hardware,
software, and network components of a Windows operating system or domain,
but also has an auto execution feature. In the sample reviewed by Rapid7, the .msc
payload masquerades as a document to socially engineer the user into initiating
execution via a lure document with associated icon.

Figure 9 - Opening the MSC document with word icon and lure10

It is worthy to note that when double-clicking msc files on default windows systems
there is a User Account Control (UAC) warning that may hinder an attack.

Figure 10 - A CommandLine Task in the .msc

In the screenshot above showing an MSC CommandLine Task payload:
1. Open Google Docs lure
2. Execute tasklist and write results to file
3. Echo VBScript to disk
4. Execute VBScript

The VBScript in this example simply POSTs collected process information to theserver. Despite this being a simple example, public reporting links Kimsuky to thesame infrastructure and similar payload components to other confirmed Kimsuky
activity.

Script based execution
Rapid7 notes heavy use of scripting capabilities in Kimsuky operations, including
the use of PowerShell, JavaScript, VBScript, and batch files, alongside LNK and
CHM based execution. Despite being labeled as a “less technical” APT due to theirheavy use of basic scripting techniques, Kimsuky is measured by their success.
As an example: below we can see implementation of a decoded PowerShell payload
extracted from a LNK.
1. Downloads a PowerShell script from Google Drive and writes to disk as

swolf-first.ps1.
2. Sets a scheduled task — “MicrosoftEdgeUpdateVersion”— for execution andpersistence to run the script every 60 minutes.
3. Downloads and opens an RTF lure from Google Drive to show the user an

expected document.

11

Figure 11 - Stage 1 payload executes via scheduled task and opens RTF lure

The second stage reflectively loads XeroRAT as a final payload. The script:
1. Defines GzExtract function to gunzip a byte array.
2. Downloads an obfuscated gzip payload from google drive. The payload

has an RTF magic file header, likely as a way to bypass suspicious file typecontrols.
3. Replaces first 7 bytes with Gzip magic file header bytes.
4. Calls GzExtract function and loads resulting assembly bytes into the runningPowerShell process.

Figure 12 - Stage 2 payload downloads obfuscated gzip payload, extracts and loads inmemory12In another example of JavaScript execution of Kimsuky AppleSeed malware,
Rapid7 observed use of double base64 encoding of both payload and lure. In thiscase execution contained an ActiveX decode and the well known lolbin certutil.
Some other examples used in this javascript:• Simple string concatenation to obfuscate detection efforts• Variable substitution• Simple folder traversal e.g C:\Windows\..\ProgramData\ = C:\ProgramData\• Embedded files double base64 encoded — ActiveX decode and certutil combined
to bypass embedded file searches.

Figure 13 - Decoded appleseed malware execution

MalwareKimsuky has been known to deploy a wide variety of malware across operations
and actively develop new iterations. Rapid7 has observed evidence of regularly
deploying different malware stages with similar capabilities even on the same
host. Rapid7 assesses this behavior is due to active development and to maintain
access rather than focus on stealth. Kimsuky’s main objectives are credential theftand mail access in less security mature organizations / individuals.
Observed Malware trends from Kimsuky:• PowerShell, BAT file, or Windows Scripting Host and simple command and control• Information stealers designed to harvest sensitive information and credentials
from infected hosts13• Remote access capabilities, including exfiltration of collected data
• Interest in open source .NET and custom Golang RATs
• Packing and simple obfuscation techniques to mask malware from basic
detection methods• Custom encryption and LOLbin techniques like automated exfil and Base64
certutil encoding

A technical deep dive of all Kimsuky malware is beyond the scope of this paper,
however, we have included a brief description of some of the common Windows
malware for further reading and research.
BabyShark: VBScript based malware originally used in macro based attacks.
Known originally for its custom encoding, there have been several variants recently
as Kimsuky has relied less on Macro based exploitation but maintained VBScript
capabilities for initial post exploitation tasks.
AppleSeed: A backdoor used for actions on objectives like command execution,
information stealing and including exfiltration. It is well known for double XOR
decoding routing and often delivered via JavaScript or dropper. It is generally
executed as a DLL with the use of regsvr32.exe and function name.
AlphaSeed: Similar capabilities to AppleSeed but developed in Golang. AlphaSeed
has the distinction of using Naver mail via Chrome DevTools Protocol for commandand control. It leverages cookies and ChromeDevTools opposed to hardcodedusername/password for mail authentication like AppleSeed. AlphaSeed highlights
the trend towards better capabilities using Golang which has also been observedin cross OS platform Kimsuky malware development.
.NET RATs: Historically associated with a few open source .NET RATs, Kimsuky
is known to make small inconsequential customizations of malware of this type.
Kimsuky has been observed using TutorialRAT in most recent attacks. TutorialRAT
is an open source, full-featured RAT that enables information stealing and credential
theft.

Persistence
Kimsuky relies on valid credentials for mailbox access, but Rapid7 has observed“bread and butter” persistence techniques in recent Kimsuky activity during malware
installation. Common techniques like: run keys (T1547.001), services (T1543.003)
and scheduled tasks (T1053.005) with nonchalant / in plain sight names.
Some features of Kimsuky persistence:• Untrusted scripts or binaries loading from publicly writable folders such as %temp%

or %AppData%, alternatively common malware locations like %ProgramData%(T1074.001).

• System binary proxy execution (T1218) with rundll32, regsvr32, and others.

14• Simple renaming of payloads to non binary/script extensions (e.g., .png, otherimage, or random).

• Attempting to fetch remote payload/download cradle.
Historically, Kimsuky has also used Remote Desktop Protocol (RDP), malicious
Chrome browser extensions, and is known for exploiting web services or webshells
to achieve persistence.

Infrastructure
Tracking Kimsuky infrastructure highlights how prolific their activities are. Rapid7
observed phishing infrastructure and command and control hosted around theworld through numerous hosting providers/ASNs.
Some current Kimsuky trends worth noting:• Regularly reuses IP addresses.
• Leverages similar domain names used by their targets, or generic enterprisefeature names. A great example is regular name plays on the South Korean freeNaver email service.

• Regularly use new domains as part of their activities.
• Kimsuky leverage free certificate services° Mostly Lets Encrypt° Occasional instance of ZeroSSL or self signed° Validity for the certificate is 3 months in phishing sites• Similar server folder paths in use across campaign - /down[X]/ and /upload[X]/Some examples:/js/slick/up/down0//js/slick/up/down1//js/sub/aos/dull/down1//js/sub/up/down1//pg/adm/img/upload1//pg/adm/tdr/upi/down0//temp/down1/

It is worthy to note, there has been some historical reporting of infrastructure
overlap between Kimsuky and other DPRK threat actors. For example, domain,
IP range, and shared hosting provider overlaps between Kimsuky and APT37.
Combined with similar attack vectors and TTPs, Rapid7 assesses at least somelevel of coordinated approach or shared resources within the DPRK nexus.

15

Conclusion
Despite deployment of moderate technical capabilities, Kimsuky’s skill in social
engineering and persistent approach makes them a formidable adversary. As wetrack Kimsuky, it remains clear one of the best mitigations is vigilance. This includes
both hardening with technical controls around email or corporate monitoring, andthe softer side user awareness training or sharing research.
Rapid7 Labs will continue researching and publishing insights and guidance on
defending against persistent adversaries like Kimsuky. Combined with our sharedthreat data and intelligence, this research enables us to actively assist customers
in hunting for and mitigating similar threats in the field.

Indicators of compromise
Virus Total
GitHub

Rapid7 customers
InsightIDR and Managed Detection and Response (MDR) customers have existing
detection coverage through Rapid7’s expansive library of detection rules. Rapid7
recommends installing the Insight Agent on all applicable hosts to ensure visibility
into suspicious processes and proper detection coverage. Below is a non-exhaustive
list of detections deployed and alerting on activity related to these techniques andresearch.
Detections:• Attacker Technique - PowerShell Concatenation Obfuscation• Persistence - Run Key Added by Reg.exe• Persistence - vbs Script Added to Registry Run Key• PowerShell - Concatenate Strings• PowerShell - Obfuscated Script• Suspicious Process - CHM File Runs CMD.exe to Run Certutil• Suspicious Process - HH.exe Spawns Child Process• Suspicious Process - PowerShell IO.MemoryStream• Suspicious Process - Terminal Process Execution from Microsoft Common
Console (MSC) File

• Suspicious Process - XORed Data in PowerShell

16

References
1. NSA, DPRK Cyber Actors Impersonating Targets to Collect Intelligence

https://www.nsa.gov/Press-Room/Press-Releases-Statements/PressRelease-View/Article/3413621/us-rok-agencies-alert-dprk-cyber-actorsimpersonating-targets-to-collect-intell/
2. Tom Lancaster, SHARPTONGUE: PWNING YOUR FOREIGN POLICY, ONE

INTERVIEW REQUEST AT A TIME
https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/
SharpTongue-pwning-your-foreign-policy-one-interview-request-at-a-time.pdf
3. Proofpoint, From Social Engineering to DMARC Abuse: TA427’s Art ofInformation Gatheringhttps://www.proofpoint.com/us/blog/threat-insight/social-engineeringdmarc-abuse-ta427s-art-information-gathering
4. CISA, North Korean Advanced Persistent Threat Focus: Kimsuky

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a
5. Rapid7, The Updated APT Playbook: Tales from the Kimsuky threat actor

group
https://www.rapid7.com/blog/post/2024/03/20/the-updated-apt-playbooktales-from-the-kimsuky-threat-actor-group/
6. Palo Alto - Unit42, New BabyShark Malware Targets U.S. National Security

Think Tanks
https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-snational-security-think-tanks/
7. Kroll, TODDLERSHARK: ScreenConnect Vulnerability Exploited to Deploy

BABYSHARK Variant
https://www.kroll.com/en/insights/publications/cyber/screenconnectvulnerability-exploited-to-deploy-babyshark
8. @asdasd13asbz phishing tool attribution

https://twitter.com/asdasd13asbz/status/1781143432691683342
9. Ahnlab, Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey)

https://asec.ahnlab.com/en/59590/
10. Ahnlab, Trend Analysis on Kimsuky Group’s Attacks Using AppleSeed

https://asec.ahnlab.com/en/60054/
11. Malpedia, Appleseed

https://malpedia.caad.fkie.fraunhofer.de/details/win.appleseed1712. S2W, Detailed Analysis of AlphaSeed, a new version of Kimsuky’s AppleSeed

written in Golang
https://medium-com.translate.goog/s2wblog/detailed-analysisof-alphaseed-a-new-version-of-kimsukys-appleseed-written-in-golang2c885cce352a?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_
pto=wapp&_x_tr_hist=true
13. PWC, Tracking ‘Kimsuky’, the North Korea-based cyber espionage grouphttps://www.pwc.co.uk/issues/cyber-security-services/research/trackingkimsuky-north-korea-based-cyber-espionage-group-part-1.html
14. Genians, Kimsuky APT attack discovered using Facebook & MS

management console
https://www.genians.co.kr/blog/threat_intelligence/facebook
15. New Year’s Opinion Media Column Disguised Hacking Analysis

https://www.genians.co.kr/blog/threat_intelligence/nation-state
16. Malicious code targeting Embassy in China,

https://wezard4u.tistory.com/6776

About Rapid7
Rapid7 is creating a more secure digital future for all by helping organizations strengthen
their security programs in the face of accelerating digital transformation. Our portfolioof best-in-class solutions empowers security professionals to manage risk and eliminate
threats across the entire threat landscape from apps to the cloud to traditional infrastructure
to the dark web. We foster open source communities and cutting-edge research–using
these insights to optimize our products and arm the global security community with thelatest in attacker methodology. Trusted by more than 11,000 customers worldwide, ourindustry-leading solutions and services help businesses stay ahead of attackers, ahead of
the competition, and future-ready for what’s next.
The information provided in this paper is intended for informational purposes only and Rapid7 makes no warranties, express or implied,regarding the suitability of the content for any specific purpose. The content within this paper is based on data and findings available
up to the date of its publication.
The information contained herein is provided “as is,” and readers are advised to use their own discretion when applying the information totheir specific situations. Furthermore, any third-party sources, tools, or software mentioned in this report are included for informational
purposes only. Rapid7 does not take responsibility for the accuracy, functionality, or security of these external resources.
Rapid7 is not liable for any damages, losses, or consequences that may arise from the use of the information provided within. This includes
but is not limited to direct, indirect, incidental, or consequential damages related to actions taken based on the content of this paper.
Any reproduction, distribution, or unauthorized use of this paper’s contents without explicit permission from the authors and publishers
is strictly prohibited.

PRODUCTSCONTACT US

Cloud Security

Application Security

XDR & SIEM

Orchestration & Automation

Threat Intelligence

Managed Services

rapid7.com/contact

Vulnerability Risk Management
To learn more or start a free trial, visit: https://www.rapid7.com/try/insight/© RAPID7 2024 V1.0

18