Reports linked to Kimsuky cover intrusion analysis, infrastructure, disruption efforts, and defensive guidance for affected organizations.
Search across headline titles and summaries.
Background for this topic.
Kimsuky is a name used by security researchers for an intrusion set associated with multiple espionage campaigns. Public reporting has linked activity under this name to spearphishing, malicious documents or links, credential-harvesting pages, and malware delivery. Some governments and researchers have assessed parts of this activity as connected to North Korea, but actor attribution can be uncertain and the label may cover operations that differ over time.
The main security concern is compromise of email and cloud identities: stolen passwords, session tokens, or authentication data can provide access to sensitive conversations and additional accounts. Defenders should prioritize phishing-resistant multifactor authentication, rapid patching of exposed internet-facing systems, and monitoring for unusual sign-ins, new mail-forwarding rules, persistence, and suspicious browser or endpoint activity. If exposure is suspected, preserve phishing messages and authentication logs, revoke active sessions, reset credentials, and review connected applications before closing the investigation.
ReconShark is sent via emails containing OneDrive links leading to documents with malicious macros
The North Korean state-sponsored threat actor known as Kimsuky has been discovered using a new reconnaissance tool called ReconShark as part of an ongoing global campaign
The North Korean Kimsuky hacking group has been observed employing a new version of its reconnaissance malware, now called 'ReconShark,' in a cyberespionage campaign with a global reach. [...]