Saturday, February 15, 2025
HomeCyber AttackNorth Korean Kimusky Group Attacking University Professors

North Korean Kimusky Group Attacking University Professors

Published on

SIEM as a Service

Follow Us on Google News

Kimsuky, a North Korean APT group, employs targeted phishing campaigns, leveraging DMARC exploitation to conceal social engineering, infiltrate university networks, and steal research for the Reconnaissance General Bureau. 

It aligns with North Korea’s goal of intelligence acquisition to advance its scientific capabilities, mirroring past actions of stealing nuclear, healthcare, and pharmaceutical research. 

The recent exposure of Kimsuky’s OPSEC failures provides critical insights into their operations and reinforces the ongoing threat posed by this cyber espionage group. 

Kimsuky leverages compromised internet hosts, including audko [store], dorray [site], and others, as staging grounds for attacks by deploying a heavily obfuscated webshell dubbed “Green Dinosaur,” derived from Indrajith Mini Shell 2.0, onto these compromised systems.

“Green Dinosaur” webshell

This webshell, stripped of unnecessary functions for evasion, enables remote operators to upload, download, rename, and delete files, facilitating the creation of phishing websites. 

Kimsuky has crafted phishing pages mirroring legitimate university login portals, specifically targeting Dongduk, Korea, and Yonsei universities, which have been modified to capture credentials, bypass standard encryption, and redirect victims to a decoy PDF hosted on Google Drive. 

Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Access

The PDF, disguised as an invitation to the Asan Institute for Policy Studies August Forum, is likely a social engineering tactic to increase victim trust.

Credential theft occurs through a PHP script that logs username, password, and login attempts to a server file.

Screenshot of the j_spring_security_check.php code

It utilizes modified Javascript code to steal login credentials for Korea and Yonsei universities. The attack injects malicious code into legitimate login pages that resemble the real university portals. 

Korea University’s attack alters Javascript to capture user input, while Yonsei University’s attack modifies HTML to achieve the same result. 

Both targets use login.php to receive stolen credentials but ultimately redirect to the genuine login pages to avoid immediate suspicion by leveraging trust in established university portals to trick victims into surrendering their login information.  

Screenshot of the modified Yonsei login page HTML code

Kimsuky employs a generic phishing toolkit to target Naver accounts, which functions as a rudimentary proxy, similar to Evilginx, designed to capture cookies and credentials from unsuspecting victims. 

Once compromised, users are presented with deceptive pop-ups mimicking server communication errors, prompting them to re-enter login details. Upon clicking “OK,” victims are redirected to a fraudulent Naver login page, where their credentials are stolen. 

By leveraging a custom PHPMailer implementation named “SendMail” hosted on GreenDinosaur to distribute phishing emails, the attacker compromised a Seoul National University professor’s email account to access a South Korean SMTP server for Dooray CRM. 

Screenshot of Kimsuky’s malicious popup telling the user to login again due to a server communication error

According to Resilience, these accounts, sharing identical credentials and recovery emails, were exploited to target employees at Dongduk, Korea, and Yonsei Universities, among others. 

Attackers configured a SendMail server to distribute Naver-themed phishing emails using compromised Gmail and Daum accounts.

Malicious emails, such as those claiming Naver account deletion or email restrictions, direct victims to multiple phishing websites.

Download Free Cybersecurity Planning Checklist for SME Leaders (PDF) – Free Download

Kaaviya
Kaaviya
Kaaviya is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.

Latest articles

Fake BSOD Attack Launched via Malicious Python Script

A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick...

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using...

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign...

North Korean IT Workers Penetrate Global Firms to Install System Backdoors

In a concerning escalation of cyber threats, North Korean IT operatives have infiltrated global...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Astaroth 2FA Phishing Kit Targets Gmail, Yahoo, Office 365, and Third-Party Logins

A new phishing kit named Astaroth has emerged as a significant threat in the...

Device Code Phishing Attack Exploits Authentication Flow to Hijack Tokens

A sophisticated phishing campaign leveraging the device code authentication flow has been identified by...

New Phishing Attacks Abuses Webflow CDN & CAPTCHAs to Steal Credit Card details

Netskope Threat Labs has uncovered a sophisticated phishing campaign targeting users across various industries,...