Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
42 IOCs
Kimsuky targets organizations with PebbleDash-based tools
Threat Actors
Excerpt
Over the past few months, we have conducted an in-depth analysis of specific activity clusters of Kimsuky (aka APT43, Ruby Sleet, Black Banshee, Sparkling Pisces, Velvet Chollima, and Springtail), a prolific Korean-speaking threat actor. Our research revealed notable tactical shifts throughout multiple phases of the group’s latest campaigns. Kimsuky has continuously introduced new malware variants based on the PebbleDash platform, a tool historically leveraged by the…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →42 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | erp.spaceme.p-e.kr | High | Score 58/100 | First seen |
| MD5 | 5c373c2116ab4a615e622f577e22e9be | Medium | Score 51/100 | First seen |
| URL | https://www.pyrotech.co.kr/common/include/tech/default.php | High | Score 58/100 | First seen |
| MD5 | 995a0a49ae4b244928b3f67e2bfd7a6e | Medium | Score 51/100 | First seen |
| Domain | load.supershop.o-r.kr | High | Score 58/100 | First seen |
| Domain | load.auraria.org | High | Score 58/100 | First seen |
| URL | https://www.yespp.co.kr/common/include/code/out.php | High | Score 58/100 | First seen |
| MD5 | 678fb1a87af525c33ba2492552d5c0e2 | Medium | Score 51/100 | First seen |
| MD5 | 58ac2f65e335922be3f60e57099dc8a3 | Medium | Score 51/100 | First seen |
| SHA1 | bf9252a2fb45be6893dd8870c0bf37e2e1766d61 | Medium | Score 51/100 | First seen |
| MD5 | d1ec20144c83bba921243e72c517da5e | Medium | Score 51/100 | First seen |
| MD5 | 8983ffa6da23e0b99ccc58c17b9788c7 | Medium | Score 51/100 | First seen |
| MD5 | 08160acf08fccecde7b34090db18b321 | Medium | Score 51/100 | First seen |
| Domain | node896147.dwservice.net | High | Score 58/100 | First seen |
| URL | http://newjo-imd.com/common/include/library/default.php | High | Score 58/100 | First seen |
| MD5 | f73ba062116ea9f37d072aa41c7f5108 | Medium | Score 51/100 | First seen |
| Domain | opedromos1.r-e.kr | High | Score 58/100 | First seen |
| Domain | load.yju.o-r.kr | High | Score 58/100 | First seen |
| Domain | load.ssangyongcne.o-r.kr | High | Score 58/100 | First seen |
| Domain | attach.docucloud.o-r.kr | High | Score 58/100 | First seen |
| MD5 | 9fe43e08c8f446554340f972dac8a68c | Medium | Score 51/100 | First seen |
| MD5 | 7e0825019d0de0c1c4a1673f94043ddb | Medium | Score 51/100 | First seen |
| MD5 | 52f1ff082e981cbdfd1f045c6021c63f | Medium | Score 51/100 | First seen |
| MD5 | 8e15c4d4f71bdd9dbc48cd2cabc87806 | Medium | Score 51/100 | First seen |
| Domain | node484265.dwservice.net | High | Score 58/100 | First seen |
| URL | https://vscode.dev/tunnel | High | Score 58/100 | First seen |
| Domain | cms.spaceyou.o-r.kr | High | Score 58/100 | First seen |
| MD5 | f4465403f9693939fe9c439f0ab33610 | Medium | Score 51/100 | First seen |
| MD5 | c42ae004badddd3017adadbdd1421e00 | Medium | Score 51/100 | First seen |
| Domain | node828765.dwservice.net | High | Score 58/100 | First seen |
| MD5 | c19aeaedbbfc4e029f7e9bdface495b9 | Medium | Score 51/100 | First seen |
| URL | http://female-disorder-beta-metropolitan.trycloudflare.com/index.php | High | Score 58/100 | First seen |
| URL | https://file.bigcloud.n-e.kr/index.php | High | Score 58/100 | First seen |
| SHA1 | 1e3c50d64110be466c0b4a45222e81d2c9352888 | Medium | Score 51/100 | First seen |
| Domain | morames.r-e.kr | High | Score 58/100 | First seen |
| MD5 | 94faed9af49c98a89c8acc55e97276c9 | Medium | Score 51/100 | First seen |
| URL | https://vscode.dev/tunnel/” | High | Score 58/100 | First seen |
| Domain | load.erasecloud.n-e.kr | High | Score 58/100 | First seen |
| MD5 | a7f0a18ac87e982d6f32f7a715e12532 | Medium | Score 51/100 | First seen |
| URL | https://www.dwservice.net/ | High | Score 58/100 | First seen |
| MD5 | 65fc9f06de5603e2c1af9b4f288bb22c | Medium | Score 51/100 | First seen |
| MD5 | 9ca5f93a732f404bbb2cee848f5bbda0 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…