230821조간용_한미연합연습_노린_북_김수키_소행_사이버_고_0ofdxHu.pdf (339 KB)

South Korean police attributed a malicious email campaign targeting personnel assigned to South Korea-U.S. joint military exercises to Kimsuky. Investigators said the group had persistently targeted a domestic war-game operations company since April 2022, compromised an employee mailbox in January, installed malware on company systems, and monitored work status and emails through remote access. The attackers then used stolen employee information to send tax-document-themed malicious emails to personnel assigned to the combined exercise simulation room; military network defenses blocked the malware, but some external personal PCs were infected after forwarded messages were opened.