Malware Disguised as Normal Documents (Kimsuky)

The ASEC analysis team has recently discovered that the malware introduced in the post, <Malware Disguised as a Manuscript Solicitation Letter (Targeting Security-Related Workers)>, is being distributed to broadcasting and ordinary companies as well as those in the security-related field. Identical to the malware introduced in the blog post above, all the malware documents utilize the template injection technique and download malicious word macro documents to execute themselves. The distributed filenames are as follows:

• [kbs Sunday Diagnosis] …

analysis asec blog blog post companies distributed documents download injection kimsuky letter macro malicious malware malware analysis manuscript security targeting team template template injection word workers