Based on the source and likely targets, these types of attacks are on par with past attacks stemming from typical North Korean groups such as APT37 as South Korea has historically been a primary target of the group, especially its government officials. request_raw: mpVI=MDA[REDACTED]wxMC44LjIuNywxNQ== request_raw mpCMD=sss&mpVID=00-[REDACTED MAC]-00 C2 and infrastructure The threat actor’s infrastructure appears to be solely based on two compromised websites that appear to be legitimate businesses. The final stage of the attack chain ends with an interesting and persistent malware embedded into the target’s machine which runs on a scheduled task and immediately opens communication over HTTP. The entire malicious infrastructure used in the STARK#MULE campaign is centered around legitimate compromised Korean e-commerce websites.