New Kimsuki (APT-43) active infrastructure and campaign discovered
Source Reddit ThreatIntel
Discussion
A new active campaign by the Kimsuki (APT-43) group has been discovered targeting AI, blockchain, and logistics sectors in Europe and the United States. The campaign uses fake job offers, invitations, and package tracking notifications to deliver an infostealer malware. Attackers impersonate about 50 companies and operate a dedicated platform to track victim interactions and credential theft. The campaign is attributed with high confidence to North Korea and is linked to the UNK_DeadDrop cluster and Kimsuky group (APT-43).
r/threatintel (opens in a new tab)u/StormshieldArgos0 points0 comments
Stormshield's Cyber Threat Intelligence team has uncovered the Trigram campaign, targeting the AI, blockchain, and logistics sectors across Europe and the United States.
- The Bait: Threat actors impersonate 50 companies using fake job offers, invitations, and package tracking notifications to deliver an infostealer to victims.
- Behind the Scenes: A dedicated platform enables the attackers to track the entire operation end-to-end, from the initial click to credential theft.
By correlating this data with research from Proofpoint, SafeDep and Genians, Stormshield attributes this campaign with high confidence to North Korea, as a continuation of the UNK_DeadDrop cluster and the Kimsuky group (APT-43).