코로나19 내용으로 가장한 김수키(Kimsuky) 조직의 스모크 스크린 APT 공격 주의!
2020-02-28 • ESTSecurity • Beware of smoke screen APT attacks by the Kimsuky organization disguised as COVID-19 content! •
ESRC reports a Korean-language COVID-19 lure attributed as likely Kimsuky activity and analyzed as part of the group's SmokeScreen campaign. The spear-phishing targeted an international exchange and diplomacy-related organization with a malicious Word document named “Coronavirus response.doc” that prompted the recipient to enable macros. If enabled, the macro displayed plausible COVID-19 meeting content while using mshta to contact attacker-controlled infrastructure hosted on a domestic service and retrieve additional script content beginning with search.hta. The activity matters because it adapted pandemic anxiety and increased remote-work email exposure into a localized spear-phishing chain aimed at Korean organizations.