MalwarePublished 23 May 2025

Case of Larva-25004 Group (Related to Kimsuky) Exploiting Additional Certificate - Malware Signed with Nexaweb Certificate

Source AlienVault OTX General

Description

AhnLab Security Intelligence Center discovered malware signed with Nexaweb Inc.'s certificate, linked to the Kimsuky group's activities. The malware, tracked as Larva-25004, was found in two files signed on May 24 and 28, 2024. When executed, it displays a PDF file related to employment as bait, likely targeting individuals interested in defense company jobs. The certificate's authenticity is still under investigation. The malware's characteristics match those of files signed with a Korean company's certificate, previously reported in connection with Kimsuky. This incident highlights the ongoing threat of certificate exploitation by sophisticated threat actors.

Impact

For European organizations, particularly those in the defense, aerospace, and critical infrastructure sectors, the Larva-25004 malware poses a significant espionage and operational risk. The malware’s use of employment-related bait suggests a spear-phishing vector aimed at individuals with access to sensitive information or systems, increasing the likelihood of targeted compromise. Successful execution could enable unauthorized access, data exfiltration, and lateral movement within networks, potentially compromising confidential defense projects, strategic technologies, or intellectual property. The exploitation of a legitimate certificate complicates detection and increases the chance of successful infiltration and prolonged undetected presence. European defense contractors, research institutions, and organizations collaborating with Korean or allied defense entities may be particularly vulnerable. Although the malware does not currently appear to cause immediate disruption, its stealth and targeted nature could lead to significant intelligence losses and operational impacts over time, undermining national security interests and industrial competitiveness.

Defensive guidance

1. Enforce strict certificate validation policies, including real-time certificate revocation checks via CRL and OCSP, to detect and block binaries signed with compromised or unauthorized certificates. 2. Implement application whitelisting that evaluates not only the presence of a valid signature but also the reputation and trustworthiness of the certificate issuer and signer, incorporating threat intelligence on known malicious certificates. 3. Enhance email security by deploying advanced attachment sandboxing and heuristic analysis focused on employment-related documents, especially those from external or unverified sources. 4. Conduct targeted user awareness training emphasizing spear-phishing tactics involving recruitment lures, teaching users to verify unexpected job-related communications through independent channels. 5. Monitor endpoint and network activity for anomalous behaviors such as unusual scheduled tasks, input capture attempts, or command interpreter usage indicative of malware execution. 6. Integrate threat intelligence feeds containing indicators of compromise, including the provided file hashes, into security monitoring and incident response workflows for rapid detection and containment. 7. Collaborate with certificate authorities and software vendors to promptly revoke and replace compromised certificates and notify affected organizations. 8. For organizations with defense sector exposure, deploy enhanced logging, anomaly detection, and endpoint detection and response (EDR) solutions tailored to identify lateral movement, credential misuse, and other APT behaviors associated with Kimsuky. 9. Regularly audit and restrict permissions related to certificate management and software signing within the organization to prevent unauthorized certificate use.

Indicators of compromise

Hashes 11

0315e137a6e2d658f07af454c63a0af2
27d4ff7439694041ef86233c2b804e1f
28ce4d33e7994c2be95816eea5773ed1
73d2899aade924476e58addf26254c2e
aa8936431f7bc0fabb0b9efb6ea153f9
0e42f20eb0aab1a4570b0e96b36ceb88f2c82643
3671eaf95ce83f769ee2bd73f5c1c9e85b34fee1
e9f134a3f4bc5bec1f71906c37f325808b9da2d9
000e2926f6e094d01c64ff972e958cd38590299e9128a766868088aa273599c7
5b3cc9cced1ef0cb0bba5549cc2ac09c49ae10554d2409ea16bc5e118d278c15

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2025, 22:19 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Hashes 11

Community reviews

Related threats