North Korea’s Kimusky Hackers Targeting University Professors

Kimsuky, a North Korean APT group, has been conducting global intelligence operations since 2012, targeting South Korea, the United States, and Europe by building trust through email correspondence before delivering malicious attachments. 

Recent NSA and FBI advisories highlight Kimsuky’s abuse of misconfigured DMARC records to conceal phishing attempts, impersonating academics, journalists, and East Asian experts to infiltrate target organizations. 

Researchers recently exploited an OPSEC failure by Kimsuky, a North Korean state-sponsored threat actor, to acquire sensitive data, including source code, credentials, logs, and internal documents. 

Analysis indicates Kimsuky is targeting university personnel for espionage, stealing research and intelligence to benefit North Korea’s Reconnaissance General Bureau, which aligns with Kimsuky’s historical targeting of the nuclear, healthcare, and pharmaceutical sectors, suggesting a broader intelligence-gathering campaign to bolster North Korea’s scientific capabilities. 

It leverages compromised internet hosts, including audko [store], dorray [site], and others, as staging grounds for attacks by deploying a modified version of the Indrajith Mini Shell 2.0 webshell, dubbed “Green Dinosaur,” on these compromised systems. 

The webshell, stripped of unnecessary functions for evasion, enables operators to upload, download, rename, and delete files, facilitating the establishment of phishing websites. 

Kimsuky operators created phishing pages by cloning legitimate university login portals, specifically targeting Dongduk, Korea, Yonsei Universities, and Naver accounts. 

They modified the cloned pages to exfiltrate user credentials by disabling the original password encryption and redirecting login attempts to a malicious PHP script, which captures username, password, and login attempt data, transmitting it to a remote server for subsequent exploitation. 

Threat actors have compromised the Dongduk University login page by bypassing standard encryption and redirecting login attempts to a malicious PHP script, which logs stolen credentials to a local file, disguising the attack as a login failure on the first attempt and a successful login on the second. 

To lure victims, the script redirects successful attempts to a phishing PDF hosted on Google Drive, mimicking a legitimate invitation. 

The PDF and associated Google account exhibit strong ties to the South-North Korea Exchanges and Cooperation Support Association, aligning with a recent phishing warning by the Asan Institute. 

According to Resilience, the Kimsuky phishing campaign utilizes modified JavaScript code to steal login credentials for Korea University and Yonsei University. 

The phishing pages mimic the legitimate login pages and redirect victims to the real login pages after credential harvesting, while a non-target-specific phishing toolkit is used to steal Naver accounts using a fake login page and pop-up messages.

Kimsuky leveraged a custom PHPMailer implementation named “SendMail” hosted on GreenDinosaur to distribute phishing emails. Compromising a Seoul National University professor’s email account, the attacker accessed a South Korean Dooray SMTP server. 

Numerous Gmail and Daum accounts, likely harvested, were used as sender addresses, which were configured with identical credentials and recovery emails and employed to target multiple universities, including Dongduk, Korea, and Yonsei. 

Also Read:

Massive DDOS Attack With 419 TB of Malicious Traffic Hits in 24 Hours

See more