ATIP_2023_Apr_Threat-Trend-Report-on-Kimsuky-Group.pdf (474 KB)

AhnLab’s April 2023 Kimsuky trend report says observed Kimsuky activity fell to less than half of March’s volume, but the group continued to show changes across FlowerPower, RandomQuery, and AppleSeed operations. FlowerPower continued using Korean-domain services such as kro.kr, n-e.kr, o-r.kr, p-e.kr, r-e.kr, and Punycode domains from 내도메인.한국, while RandomQuery showed no major change beyond additional FQDN discoveries. The most notable AppleSeed issue was that a domain used to distribute AppleSeed also delivered a Google Chrome Remote Desktop setup script, raising the possibility of a shift from the group’s usual VNC-based remote-control tooling such as TightVNC or TinyNuke. ASEC also observed AppleSeed execution using two different argument values instead of the usual repeated argument value between dropper and payload.