North Korean Kimusky Group Attacking University Professors

Kimsuky, a North Korean APT group, employs targeted phishing campaigns, leveraging DMARC exploitation to conceal social engineering, infiltrate university networks, and steal research for the Reconnaissance General Bureau. 

It aligns with North Korea’s goal of intelligence acquisition to advance its scientific capabilities, mirroring past actions of stealing nuclear, healthcare, and pharmaceutical research. 

The recent exposure of Kimsuky’s OPSEC failures provides critical insights into their operations and reinforces the ongoing threat posed by this cyber espionage group. 

Kimsuky leverages compromised internet hosts, including audko [store], dorray [site], and others, as staging grounds for attacks by deploying a heavily obfuscated webshell dubbed “Green Dinosaur,” derived from Indrajith Mini Shell 2.0, onto these compromised systems.

This webshell, stripped of unnecessary functions for evasion, enables remote operators to upload, download, rename, and delete files, facilitating the creation of phishing websites. 

Kimsuky has crafted phishing pages mirroring legitimate university login portals, specifically targeting Dongduk, Korea, and Yonsei universities, which have been modified to capture credentials, bypass standard encryption, and redirect victims to a decoy PDF hosted on Google Drive. 

Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Access

The PDF, disguised as an invitation to the Asan Institute for Policy Studies August Forum, is likely a social engineering tactic to increase victim trust.

Credential theft occurs through a PHP script that logs username, password, and login attempts to a server file.

It utilizes modified Javascript code to steal login credentials for Korea and Yonsei universities. The attack injects malicious code into legitimate login pages that resemble the real university portals. 

Korea University’s attack alters Javascript to capture user input, while Yonsei University’s attack modifies HTML to achieve the same result. 

Both targets use login.php to receive stolen credentials but ultimately redirect to the genuine login pages to avoid immediate suspicion by leveraging trust in established university portals to trick victims into surrendering their login information.  

Kimsuky employs a generic phishing toolkit to target Naver accounts, which functions as a rudimentary proxy, similar to Evilginx, designed to capture cookies and credentials from unsuspecting victims. 

Once compromised, users are presented with deceptive pop-ups mimicking server communication errors, prompting them to re-enter login details. Upon clicking “OK,” victims are redirected to a fraudulent Naver login page, where their credentials are stolen. 

By leveraging a custom PHPMailer implementation named “SendMail” hosted on GreenDinosaur to distribute phishing emails, the attacker compromised a Seoul National University professor’s email account to access a South Korean SMTP server for Dooray CRM. 

According to Resilience, these accounts, sharing identical credentials and recovery emails, were exploited to target employees at Dongduk, Korea, and Yonsei Universities, among others. 

Attackers configured a SendMail server to distribute Naver-themed phishing emails using compromised Gmail and Daum accounts.

Malicious emails, such as those claiming Naver account deletion or email restrictions, direct victims to multiple phishing websites.

Download Free Cybersecurity Planning Checklist for SME Leaders (PDF) – Free Download