Kimsuki hackers use commodity RATs with custom Gold Dragon malware


Level 37
Thread author
Top poster
Feb 4, 2016
South Korean researchers have spotted a new wave of activity from the Kimsuky hacking group, involving commodity open-source remote access tools dropped with their custom backdoor, Gold Dragon.
Kimsuky is a North Korean state-sponsored hacking group, also known as TA406, who has been actively involved in cyber-espionage campaigns since 2017.

The group has demonstrated impressive operational versatility and threat activity pluralism, engaging in malware distribution, phishing, data collection, and even cryptocurrency theft.
In the latest campaign, spotted by analysts at ASEC (AhnLab), Kimsuky uses xRAT in targeted attacks against South Korean entities. The campaign started on January 24, 2022, and is still ongoing.

Commodity RAT​

xRAT is an open-source remote access and administration tool available for free on GitHub. The malware provides a range of features such as keylogging, remote shell, file manager actions, reverse HTTPS proxy, AES-128 communication, and automated social engineering.