North Korean APT Hackers Target Users on Social Media to Spread Malware

The Genians Security Center (GSC) has uncovered a highly sophisticated Advanced Persistent Threat (APT) campaign orchestrated by the North Korean state-sponsored hacking group Kimsuky.

Active between March and April 2025, this campaign, identified as part of the notorious ‘AppleSeed’ operation, targets individuals in South Korea through a multi-pronged approach using Facebook, email, and Telegram.

Sophisticated Triple-Channel Attack Strategy Unveiled

The attackers employ a deceptive guise of credibility, posing as missionaries or researchers associated with North Korean defector volunteer activities.

By initiating seemingly harmless conversations on social media, they lure victims into downloading malicious files, often disguised as legitimate documents, to infiltrate systems and extract sensitive information.

This operation showcases Kimsuky’s evolving tactics, leveraging social engineering and tailored content to exploit trust in online interactions, particularly among activists and defense-related personnel.

Delving into the technical underpinnings of this campaign, Kimsuky employs a multi-stage infiltration strategy that demonstrates their adeptness at evading traditional security measures.

The initial contact often begins on Facebook, where attackers use hijacked or fake accounts to send friend requests and direct messages.

Technical Intricacies of Malware Deployment

Once trust is established, they deliver malicious files compressed in Korea-specific EGG ALZIP format, often password-protected to bypass signature-based detection tools.

These files, such as the obfuscated JScript file named ‘탈북민지원봉사활동.jse’ (Defector Volunteer Support), execute under Microsoft’s Windows Script Host (WSH) to create decoy PDFs and malicious DLLs like ‘vmZMXSx.eNwm’.

These DLLs, protected by VMProtect to hinder reverse engineering, are loaded silently using commands like ‘regsvr32.exe’, ensuring persistence through registry entries such as ‘TripServiceUpdate’ in HKCU.

The malware further employs Base64 encoding, XOR decryption, and RSA-encrypted RC4 keys to secure communication with command-and-control (C2) servers like ‘woana.n-e[.]kr’.

System information is collected, encrypted, and transmitted disguised as PDF data, revealing the malware’s function as a remote access trojan (RAT) capable of executing commands from the C2 server in a continuous loop.

According to the Report, This intricate design not only hides malicious activity but also targets Windows PC environments specifically, instructing victims to use specific decompression tools to ensure execution.

Historical parallels with Kimsuky tools like BabyShark and FlowerPower, alongside spear phishing via LinkedIn, indicate a persistent threat pattern exploiting professional and social networks.

The Genian EDR solution, utilizing behavior-based detection and machine learning, has proven effective in identifying these threats at the execution stage, offering critical visibility into attack storylines through process mapping and event investigation.

This alarming campaign underscores the urgent need for heightened cybersecurity awareness and robust endpoint detection solutions to combat nation-state threats that exploit personal and professional trust networks with devastating precision.

Indicators of Compromise (IOC)

Type	Value
MD5 Hashes	2f6fe22be1ed2a6ba42689747c9e18a0, 5a223c70b65c4d74fea98ba39bf5d127, … (list truncated for brevity)
C2 Domains	afcafe.kro[.]kr, dirwear.000webhostapp[.]com, download.uberlingen[.]com, hyper.cadorg.p-e[.]kr, …

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.