Kimsuky Espionage Campaign
2021-08-23 • Inquest •
https://inquest.net/blog/2021/08/23/kimsuky-espionage-campaign
A JavaScript file masquerading as a PDF used a Korean Foreign Ministry newsletter lure to display a benign document while decoding and launching hidden payloads. The infection chain embedded Base64 data, extracted a legitimate lure file and a UPX-packed x64 DLL, and ultimately produced an unpacked executable identified in the excerpt as a Kimsuky espionage tool. The malware searched local directories and USB drives for document types including HWP, PDF, DOC, XLS, PPT, and TXT, indicating a document-theft objective. Persistence was established through a RunOnce registry entry invoking regsvr32 against an ESTsoft-themed DLL path, and the infrastructure included texts.letterpaper.press along with multiple SHA-256 indicators.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| HASH | e5bd835a7f26ca450770fd61effe22a… | 2021-08-23 | 2021-08-23 |
| HASH | 0a4f2cff4d4613c08b39c9f18253af0… | 2021-08-23 | 2021-08-23 |
| HASH | 20eff877aeff0afaa8a5d29fe272bdd… | 2021-08-23 | 2021-08-23 |
| HASH | 3251c02ff0fc90dccd79b94fb2064fb… | 2021-08-23 | 2021-08-23 |
| HASH | ae50cf4339ff2f2b3a50cf8e8027b81… | 2021-08-23 | 2021-08-23 |
| HASH | fa4d05e42778581d931f07bb213389f… | 2021-08-23 | 2021-08-23 |
| HASH | a30afeea0bb774b975c0f8027320027… | 2021-08-23 | 2021-08-23 |
| URL | http://texts.letterpaper.press | 2021-08-23 | 2021-08-23 |
| DOMAIN | texts.letterpaper.press | 2021-08-23 | 2021-08-23 |