Mandiant APT43 March 2024

Kimsuky has executed a variety of PowerShell scripts including Invoke-Mimikatz. Kimsuky has also utilized PowerShell scripts for execution, persistence, and defense evasion. Kimsuky has leveraged PowerShell’s cmdlet `Expand-Archive` to extract contents of zip files into the same directory. Kimsuky has employed ClickFix type tactics enticing victims to copy and paste malicious PowerShell commands and scripts, where the scripts ultimately led to QuasarRAT.

BabyShark can execute additional VisualBasic content.

Kimsuky has used spearphishing to gain initial access and intelligence.

Kimsuky has used funds from stolen and laundered cryptocurrency to acquire operational infrastructure.

Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.

Kimsuky has compromised legitimate sites and used them to distribute malware.

Kimsuky has leveraged stolen PII to create accounts.

Kimsuky has created email accounts for phishing operations.

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.

Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.

Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants. Kimsuky has also hosted malicious payloads on Dropbox.

Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory. Kimsuky has also used reflective loading through .NET assembly using `[System.Reflection.Assembly]::Load`.

Kimsuky has stolen and laundered cryptocurrency to self-fund operations including the acquisition of infrastructure.