VB2020-46.pdf (2 MB)

The Virus Bulletin presentation maps Kimsuky/Black Banshee tradecraft across complementary campaigns targeting South Korean government and media, defense and aerospace, diplomacy, national-security policy, cryptocurrency, and North Korea-related research communities. It clusters BabyShark, AppleSeed, GoldDragon/GHOST419, FlowerPower, WildCommand, and related activity by shared malware routines, C2 URL structures, server-side scripts, and infrastructure pivots. The source highlights recurring artifacts such as the WebKitFormBoundarywhpFxMBe19cSjFnG boundary, VBScript-based sequential downloaders, PowerShell victim-profiling implants, Run Key persistence, encoded HTTP POST exfiltration, and C2 paths including jonashartley and datastore infrastructure. The analysis treats those overlaps as evidence for how Kimsuky campaigns support broader North Korea-linked espionage objectives.