20231101_Kimsuky_OP.-Covert-Stalker.pdf (6 MB)

AhnLab tracks Kimsuky activity over a 17-month period under the name Operation Covert Stalker, focusing on phishing and malware operations against people and organizations connected to North Korea, politics, diplomacy, defense, and security. The report describes credential-theft phishing that impersonated normal URLs, malicious HWP/Office/script/LNK/batch attachments, and C2 infrastructure operated through compromised sites and web shells such as Green Dinosaur and WebadminPHP. It also documents post-compromise tradecraft including RDP access account creation, RDP Wrapper, Quasar RAT, Ammyy RAT, AnyDesk, TeamViewer, CVE-2019-0708 scanning/exploitation tooling, and log deletion. AhnLab assesses the activity as Kimsuky based on overlapping infrastructure and tooling, observed phishing and C2 operations, and North Korean language artifacts such as '련동', '봉사기', and '대면부' in malware or server-side code. One notable finding is the suspected intentional use of BlackBit ransomware on compromised systems, likely to obscure intrusion traces rather than for a conventional ransomware monetization campaign.