Phishing

Kimsuky — also known as APT43, Black Banshee, TA427, and Velvet Chollima — commences intrusions with the distribution of phishing emails with a ZIP archive attachment containing an LNK file seemingly spoofing legitimate documents.

Attacks involved the delivery of malicious emails warning travelers of potential denied entry due to incomplete immigration requirements that include a link redirecting to a fake government portal-spoofing website facilitating login credential and payment data theft, a report from Cofense revealed.

After establishing trust with targets through the spoofing of a South Korean government official, Kimsuky — also known as APT43, ARCHIPELAGO, Black Banshee, Velvet Chollima, and Thallium — proceeded to distribute spear-phishing emails with a PDF document and a link redirecting to a website with PowerShell and code execution instructions.

Intrusions involved the distribution of an obfuscated backdoor in the guise of a GTM and Google Analytics script for web analytics and advertising, which when executed from a Magento database table facilitates the exfiltration of credit card details, according to a report from Sucuri.

Threat actors exploiting Salesforce's automated mailing service sent malicious emails with fake Facebook logos warning of copyright violations and account restrictions should recipients fail to contest the claim using a link that redirects to a phony Facebook support page seeking their credentials.

Also partially impacted by the incident — which involved the accidental takedown of the whole R2 Gateway service instead of the targeted endpoint alone — were Cloudflare's Cache Purge, Durable Objects, and Workers & Pages services.

The North Korean APT group has leveraged a custom RDP Wrapper and new malware called forceCopy in recent campaigns.

Attacks commenced with the delivery of phishing emails with a Dropbox link that downloads a ZIP archive containing an internet shortcut file with a TryCloudflare URL that fetches an LNK file for further compromise, a report from Forcepoint X-Labs showed.