Rapid7, an infosec tools vendor, has revealed that North Korea‘s cybercrime gang Kimsuky is using new tactics for their cyberattacks. They added that Kimsuky has a history of collecting information from government agencies and other related organisations, aiming to gather intelligence for the regime in Pyongyang. Their favourite tactic is spear phishing, but it yet remains to be seen what their tactic is in the latest cyberattack.
According to a Rapid7 blog post, the attacks include poisoned Microsoft Compiled HTML Help (CHM), ISO, VHD, ZIP and RAR files. Rapid7 identified poisoned CHM files, which include text, images, and hyperlinks, and explained that those files could execute JavaScript, which later installs malicious scripts that harvest information from victims’ machines.
