Procedure examples

Kimsuky has purchased hosting servers with virtual currency and prepaid cards.

Kimsuky has hosted content used for targeting efforts via web services such as Blogspot. Kimsuky has also leveraged Dropbox for hosting payloads and uploading victim system information.

Kimsuky has compromised legitimate sites and used them to distribute malware.

Kimsuky has leveraged stolen PII to create accounts.

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.

Kimsuky has created email accounts for phishing operations.

Kimsuky has compromised email accounts to send spearphishing e-mails.

Kimsuky created and used a mailing toolkit to use in spearphishing attacks.

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.

Kimsuky has stolen a valid certificate that is used to sign the malware and the dropper.

Kimsuky has obtained exploit code for various CVEs.

Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.

Kimsuky has collected victim employee name information.

Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others. Kimsuky has also used large language models (LLMs) to gather information about potential targets of interest.

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.

Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.

Kimsuky has searched for information on the target company's website.

Kimsuky has used LLMs to better understand publicly reported vulnerabilities.

Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.

Kimsuky has used links in e-mail to steal account information including web beacons for target profiling. Kimsuky has also utilized QR codes (also known as Quishing) to direct victims to malicious links through the reliance of a mobile device to scan a code with an embedded malicious URL.

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants. Kimsuky has also hosted malicious payloads on Dropbox.

Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory. Kimsuky has also used reflective loading through .NET assembly using `[System.Reflection.Assembly]::Load`.

Kimsuky has stolen and laundered cryptocurrency to self-fund operations including the acquisition of infrastructure.

Kimsuky has utilized the Sleep function to ensure execution of scripts.

Kimsuky has enumerated drives.

Kimsuky has used LLMs to identify think tanks, government organizations, and experts to inform targeting for spearphishing campaigns.

Kimsuky has also impersonated legitimate people, such as a foreign advisor, an embassy employee, and a think tank employee. Kimsuky has also purported to be a Japanese diplomat to communicate with the victims.

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.

Kimsuky has been observed disabling the system firewall.