South Korean researchers have spotted a new wave of activity from the Kimsuky hacking group, involving commodity open-source remote access tools dropped with their custom backdoor, Gold Dragon.
Kimsuky is a North Korean state-sponsored hacking group, also known as TA406, who has been actively involved in cyber-espionage campaigns since 2017.
The group has demonstrated impressive
operational versatility and threat activity pluralism, engaging in malware distribution, phishing, data collection, and even cryptocurrency theft.
In the latest campaign, spotted by analysts at ASEC (AhnLab), Kimsuky uses xRAT in targeted attacks against South Korean entities. The campaign started on January 24, 2022, and is still ongoing.
Commodity RAT
xRAT is an open-source remote access and administration tool available for free on
GitHub. The malware provides a range of features such as keylogging, remote shell, file manager actions, reverse HTTPS proxy, AES-128 communication, and automated social engineering.
