Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit

By Aleksandar Milenkoski and Tom Hegel

Executive Summary

• SentinelLabs has observed an ongoing campaign by Kimsuky, a North Korean APT group, targeting North Korea-focused information services, human rights activists, and DPRK-defector support organizations.


• The campaign focuses on file reconnaissance and information exfiltration using a variant of the RandomQuery malware, enabling subsequent precision attacks.


• Kimsuky distributes RandomQuery using Microsoft Compiled HTML Help (CHM) files, their long-running tactic for delivering diverse sets of malware.


• Kimsuky strategically employs new TLDs and domain names …

activists apt campaign dprk executive exfiltration file human human rights information kimsuky korea malware malware analysis north north korea north korean north korean apt organizations reconnaissance rights sentinellabs services support targeting tom hegel toolkit