Phishing

After establishing trust with targets through the spoofing of a South Korean government official, Kimsuky — also known as APT43, ARCHIPELAGO, Black Banshee, Velvet Chollima, and Thallium — proceeded to distribute spear-phishing emails with a PDF document and a link redirecting to a website with PowerShell and code execution instructions.

Intrusions involved the distribution of an obfuscated backdoor in the guise of a GTM and Google Analytics script for web analytics and advertising, which when executed from a Magento database table facilitates the exfiltration of credit card details, according to a report from Sucuri.

Threat actors exploiting Salesforce's automated mailing service sent malicious emails with fake Facebook logos warning of copyright violations and account restrictions should recipients fail to contest the claim using a link that redirects to a phony Facebook support page seeking their credentials.

Also partially impacted by the incident — which involved the accidental takedown of the whole R2 Gateway service instead of the targeted endpoint alone — were Cloudflare's Cache Purge, Durable Objects, and Workers & Pages services.

The North Korean APT group has leveraged a custom RDP Wrapper and new malware called forceCopy in recent campaigns.

Attacks commenced with the delivery of phishing emails with a Dropbox link that downloads a ZIP archive containing an internet shortcut file with a TryCloudflare URL that fetches an LNK file for further compromise, a report from Forcepoint X-Labs showed.

After luring targets into providing their curriculum vitae or GitHub link for fake cryptocurrency, finance, or travel job offers, attackers proceed to share a malicious repository with the project's "minimum viable product," which executes nefarious code eventually resulting in the deployment of stealer malware that targets Windows, macOS, and Linux systems.

Intrusions part of the campaign, which has been primarily targeted at the education sector, commenced with the distribution of notification-spoofing phishing emails deceiving recipients into clicking a link that redirects to a seemingly legitimate ADFS portal seeking to compromise targets' second-factor authentication, according to an analysis from Abnormal Security.