íìë_í¹ìë³ìëíí_ëíê¹ìíê³µê²ëì_2024.pdf (10 MB)

Hauri analyzed a Kimsuky spear-phishing operation that built 16 mail servers and used 24 impersonation accounts to contact more than 400 people. The targets included figures in politics, international relations, universities, policy institutions, and other domestic and overseas organizations. The report says Kimsuky did not simply send mass attachments, but researched specific victims, opened natural conversations, adjusted domains and themes when victims did not respond, and systematically managed target and domain information before delivering HTML, ISO, ZIP, VBS, and other malware-bearing content.