Monday, May 19, 2025
HomeCyber AttackNorth Korean Kimusky Group Attacking University Professors

North Korean Kimusky Group Attacking University Professors

Published on

SIEM as a Service

Follow Us on Google News

Kimsuky, a North Korean APT group, employs targeted phishing campaigns, leveraging DMARC exploitation to conceal social engineering, infiltrate university networks, and steal research for the Reconnaissance General Bureau. 

It aligns with North Korea’s goal of intelligence acquisition to advance its scientific capabilities, mirroring past actions of stealing nuclear, healthcare, and pharmaceutical research. 

The recent exposure of Kimsuky’s OPSEC failures provides critical insights into their operations and reinforces the ongoing threat posed by this cyber espionage group. 

- Advertisement - Google News

Kimsuky leverages compromised internet hosts, including audko [store], dorray [site], and others, as staging grounds for attacks by deploying a heavily obfuscated webshell dubbed “Green Dinosaur,” derived from Indrajith Mini Shell 2.0, onto these compromised systems.

“Green Dinosaur” webshell

This webshell, stripped of unnecessary functions for evasion, enables remote operators to upload, download, rename, and delete files, facilitating the creation of phishing websites. 

Kimsuky has crafted phishing pages mirroring legitimate university login portals, specifically targeting Dongduk, Korea, and Yonsei universities, which have been modified to capture credentials, bypass standard encryption, and redirect victims to a decoy PDF hosted on Google Drive. 

Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Access

The PDF, disguised as an invitation to the Asan Institute for Policy Studies August Forum, is likely a social engineering tactic to increase victim trust.

Credential theft occurs through a PHP script that logs username, password, and login attempts to a server file.

Screenshot of the j_spring_security_check.php code

It utilizes modified Javascript code to steal login credentials for Korea and Yonsei universities. The attack injects malicious code into legitimate login pages that resemble the real university portals. 

Korea University’s attack alters Javascript to capture user input, while Yonsei University’s attack modifies HTML to achieve the same result. 

Both targets use login.php to receive stolen credentials but ultimately redirect to the genuine login pages to avoid immediate suspicion by leveraging trust in established university portals to trick victims into surrendering their login information.  

Screenshot of the modified Yonsei login page HTML code

Kimsuky employs a generic phishing toolkit to target Naver accounts, which functions as a rudimentary proxy, similar to Evilginx, designed to capture cookies and credentials from unsuspecting victims. 

Once compromised, users are presented with deceptive pop-ups mimicking server communication errors, prompting them to re-enter login details. Upon clicking “OK,” victims are redirected to a fraudulent Naver login page, where their credentials are stolen. 

By leveraging a custom PHPMailer implementation named “SendMail” hosted on GreenDinosaur to distribute phishing emails, the attacker compromised a Seoul National University professor’s email account to access a South Korean SMTP server for Dooray CRM. 

Screenshot of Kimsuky’s malicious popup telling the user to login again due to a server communication error

According to Resilience, these accounts, sharing identical credentials and recovery emails, were exploited to target employees at Dongduk, Korea, and Yonsei Universities, among others. 

Attackers configured a SendMail server to distribute Naver-themed phishing emails using compromised Gmail and Daum accounts.

Malicious emails, such as those claiming Naver account deletion or email restrictions, direct victims to multiple phishing websites.

Download Free Cybersecurity Planning Checklist for SME Leaders (PDF) – Free Download

Kaaviya
Kaaviya
Kaaviya is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.

Latest articles

New Phishing Attack Poses as Zoom Meeting Invites to Steal Login Credentials

A newly identified phishing campaign is targeting unsuspecting users by masquerading as urgent Zoom...

New Hannibal Stealer Uses Stealth and Obfuscation to Evade Detection

A newly identified piece of malware, dubbed the "Hannibal Stealer," has emerged as a...

Chinese APT Hackers Target Organizations Using Korplug Loaders and Malicious USB Drives

Advanced persistent threat (APT) groups with ties to China have become persistent players in...

Cache Timing Techniques Used to Bypass Windows 11 KASLR and Reveal Kernel Base

Cache timing side-channel attacks have been used to circumvent Kernel Address Space Layout Randomization...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

New Phishing Attack Poses as Zoom Meeting Invites to Steal Login Credentials

A newly identified phishing campaign is targeting unsuspecting users by masquerading as urgent Zoom...

New Report Finds 67% of Organizations Experienced Cyber Attacks in the Last Year

A disturbing 67% of businesses in eight worldwide markets—the US, UK, Spain, the Netherlands,...

Google Reveals Hackers Targeting US Following UK Retailer Attacks

The Google Threat Intelligence Group (GTIG) recently revealed that the well-known hacker collective UNC3944,...