Zscaler Kimsuky TRANSLATEXT

TRANSLATEXT has queried the following registry key to check for installed Chrome extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist `.

TRANSLATEXT has been named `GoogleTranslate.crx` to masquerade as a legitimate Chrome extension.

TRANSLATEXT has exfiltrated collected credentials to the C2 server.

TRANSLATEXT has used PowerShell to collect system information and to upload the collected data to a Github repository.

Kimsuky has used JScript for logging and downloading additional tools. Kimsuky has used TRANSLATEXT, which contained four Javascript files for bypassing defenses, collecting sensitive information and screenshots, and exfiltrating data.

TRANSLATEXT has used HTTP to communicate with the C2 server.

TRANSLATEXT has used a dead drop resolver to retrieve configurations and commands from a public blog site.

Kimsuky has used TRANSLATEXT and a dead drop resolver to retrieve configurations and commands from a public blog site.

TRANSLATEXT has used a Github repository for C2.

Kimsuky has used Blogspot pages and a Github repository for C2. Kimsuky has also leveraged Dropbox for downloading payloads and uploading victim system information.

TRANSLATEXT has modified the following registry key to install itself as the value, granting permission to install specified extensions: ` HKCU\Software\Policies\Google\Chrome\ExtensionInstallForcelist`.

Kimsuky has captured browser screenshots using TRANSLATEXT. Kimsuky has also obtained screen captures with custom malware.

TRANSLATEXT has the ability to capture screenshots of new browser tabs, based on the presence of the `Capture` flag.

TRANSLATEXT has exfiltrated collected email addresses to the C2 server.

TRANSLATEXT has the ability to capture credentials, cookies, browser screenshots, etc. and to exfiltrate data.

Kimsuky has the ability to use form-grabbing to extract emails and passwords from web data forms.

TRANSLATEXT has the ability to use form-grabbing and event-listening to extract data from web data forms.

TRANSLATEXT has redirected clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.

Kimsuky has used TRANSLATEXT to redirect clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.

TRANSLATEXT has exfiltrated updated cookies from Google, Naver, Kakao or Daum to the C2 server.

Kimsuky has used malware, such as TRANSLATEXT, to steal and exfiltrate browser cookies.

TRANSLATEXT has stolen credentials stored in Chrome.