SharpTongue-pwning-your-foreign-policy-one-interview-request-at-a-time.pdf (2 MB)

Volexity's Virus Bulletin paper profiles SharpTongue, a North Korean threat actor often grouped under Kimsuky, through years of observed spear phishing, malware, C2 infrastructure, and incident response cases. SharpTongue targets people with access to North Korea policy information, including journalists, US and South Korean government personnel, professors, and think tanks working on sanctions, nuclear issues, or foreign policy. The group often starts with interview or collaboration emails, spoofs trusted contacts, and uses stolen correspondence to build credibility before sending credential-phishing links or malware. The paper also covers the group's efforts to shield C2 servers from researcher scrutiny and its malware arsenal after compromise.