Kimsuky APT Targets South Korean Androids, Abuses KakaoTalk for Espionage

The Kimsuky advanced persistent threat (APT) group has been actively targeting South Korean Android users by exploiting the popular messaging app KakaoTalk to conduct espionage activities. This campaign highlights the evolving tactics of Kimsuky, known for its focus on South Korean political and military targets. By abusing KakaoTalk, the attackers have leveraged a trusted communication platform to distribute malware and steal sensitive information from victims. The operation underscores the risks associated with mobile platforms and the importance of securing messaging apps against sophisticated threats. Organizations and individuals in South Korea are urged to enhance their mobile security posture and remain vigilant against phishing and malware campaigns. This incident also reflects the broader trend of nation-state actors adapting their methods to infiltrate mobile ecosystems, emphasizing the need for continuous threat intelligence and proactive defense strategies. The Kimsuky group's use of social engineering and exploitation of widely used apps demonstrates the complexity of modern cyber espionage and the critical need for comprehensive cybersecurity measures.

This Cyber News was published on www.darkreading.com. Publication date: Tue, 11 Nov 2025 16:25:04 +0000

Cyber News related to Kimsuky APT Targets South Korean Androids, Abuses KakaoTalk for Espionage

Kimsuky APT Targets South Korean Androids, Abuses KakaoTalk for Espionage - The Kimsuky advanced persistent threat (APT) group has been actively targeting South Korean Android users by exploiting the popular messaging app KakaoTalk to conduct espionage activities. This campaign highlights the evolving tactics of Kimsuky, ...
1 month ago Darkreading.com Kimsuky

North Korea's Kimsuky Attacks Rivals' Trusted Platforms - North Korea-linked threat groups are increasingly using living-off-the-land (LotL) techniques and trusted services to evade detection, with a recent Kimsuky campaign showcasing the use of PowerShell scripts and storing data in Dropbox folders, along ...
10 months ago Darkreading.com Andariel Kimsuky

North Korean Hacker Group Kimsuky Deploys New Linux Malware 'Gomir' via Trojanized Software Installers - Kimsuky, linked to North Korea's military intelligence, the Reconnaissance General Bureau, has a history of sophisticated cyber attacks aimed primarily at South Korean entities. In early February 2024, researchers at SW2, a threat intelligence ...
1 year ago Cysecurity.news Kimsuky

US govt sanctions North Korea's Kimsuky hacking group - The Treasury Department's Office of Foreign Assets Control has sanctioned the North Korean-backed Kimsuky hacking group for stealing intelligence in support of the country's strategic goals. OFAC has also sanctioned eight North Korean agents for ...
2 years ago Bleepingcomputer.com Andariel Kimsuky

North Korea-linked APT Kimsuky targeted German defense firm Diehl Defence - North Korea-linked APT group Kimsuky has been linked to a cyberattack on Diehl Defence, a defense firm specializing in the production of advanced military systems. “Researchers from Mandiant, a Google subsidiary, uncovered and analyzed a ...
1 year ago Securityaffairs.com Kimsuky

North Korea's state hackers stole $3 billion in crypto since 2017 - North Korean-backed state hackers have stolen an estimated $3 billion in a long string of hacks targeting the cryptocurrency industry over the last six years since January 2017. Kimsuky, Lazarus Group, Andariel, and other North Korean hacking groups ...
2 years ago Bleepingcomputer.com Andariel Kimsuky Lazarus Group

Kimsuky - Kimsuky, also known as Velvet Chollima and Black Banshee, is a North Korean state-backed hacker group. The group has been active since at least 2012 and initially focused on targeting South Korean government entities, think tanks, and individuals ...
2 years ago Kimsuky

Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks - Microsoft has identified a new North Korean threat actor, now tracked as Moonstone Sleet, that uses both a combination of many tried-and-true techniques used by other North Korean threat actors and unique attack methodologies to target companies for ...
1 year ago Microsoft.com

North Korea's ScarCruft Attackers Gear Up to Target Cybersecurity Pros - ScarCruft, the North Korea-sponsored advanced persistent threat group, is gearing up for targeted attacks on cybersecurity researchers and other members of the threat intelligence community - likely in a bid to steal nonpublic threat intel and ...
1 year ago Darkreading.com Kimsuky

Kimsuky Group Using Weaponized file Deploy AppleSeed Malware - Hackers use weaponized LNK files to exploit vulnerabilities in Windows operating systems. These files often contain malicious code that can be executed when the user clicks on the shortcut. These weaponized files allow threat actors to perform ...
1 year ago Cybersecuritynews.com Kimsuky

Exposed Kim Dump Exposes Kimsuky Hackers - The recent leak known as the "Exposed Kim Dump" has unveiled critical insights into the operations of the Kimsuky hacker group, a notorious North Korean cyber espionage entity. This dump includes a wealth of data that sheds light on Kimsuky's ...
3 months ago Cybersecuritynews.com Kimsuky

North Korea-Linked Group Levels Multistage Cyberattack on South Korea - North Korea-linked threat group Kimsuky has adopted a longer, eight-stage attack chain that abuses legitimate cloud services and employs evasive malware to conduct cyber espionage and financial crimes against South Korean entities. NET applications - ...
1 year ago Darkreading.com Kimsuky

State-Sponsored APT Groups Use Ransomware Tactics for Intelligence Gathering and Sabotage - State-sponsored threat groups are increasingly using ransomware-like tactics to hide more insidious activities. Russian APT group Sandworm has used ransomware programs to destroy data multiple times in the past six months, while North Korea's Lazarus ...
2 years ago Csoonline.com Andariel APT3 APT37 APT38 Kimsuky Lazarus Group BianLian

Kimsuky - Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and ...
2 years ago Attack.mitre.org Kimsuky Lazarus Group

What is an advanced persistent threat? - An advanced persistent threat is a prolonged and targeted cyber attack in which an intruder gains access to a network and remains undetected for an extended period. APT attacks are initiated to steal highly sensitive data rather than cause damage to ...
2 years ago Techtarget.com Cozy Bear APT29

Kimsuky Hackers Using ClickFix Technique to Execute Malicious Scripts on Victim Machines - Cyber Security News - The attackers impersonate legitimate entities, including government officials, news correspondents, and security personnel, to establish trust before delivering malicious payloads through encrypted archives or deceptive websites designed to mimic ...
5 months ago Cybersecuritynews.com Kimsuky

Kimsuky Hackers Deploy Weaponized LNK File in Latest Espionage Campaign - Kimsuky, a notorious North Korean hacker group, has been observed deploying a weaponized LNK file in their latest cyber espionage campaign. This attack vector leverages malicious shortcut files to execute payloads stealthily on targeted systems, ...
3 months ago Cybersecuritynews.com Kimsuky

North Korean IT worker scam is now a threat to all companies, cybersecurity experts say | The Record from Recorded Future News - Since disruptions began last year and law enforcement has publicly warned companies of the practice, DTEX’s Barnhart and others said they have seen some workers try to extort companies or hand off their access to more sophisticated North Korean ...
7 months ago Therecord.media

US, Japan and South Korea Unite to Counter North Korean Cyber Activiti - The US, Japan and South Korea have established a high-level consultative body designed to counter North Korea's cyber activities. A key purpose of the new group is to prevent cyber-attacks and crypto heists used to fund North Korea's weapons ...
2 years ago Infosecurity-magazine.com

Seoul Police Reveals: North Korean Hackers Stole South Korean Anti-Aircraft Data - South Korea: Seoul police have charged Andariel, a North Korea-based hacker group for stealing critical defense secrets from South Korea's defense companies. Allegedly, the laundering ransomware is redirected to North Korea. One of the 1.2 terabytes ...
2 years ago Cysecurity.news Andariel Lazarus Group

Kimsuky HTTPtroy Backdoor Targets South Korea Users - The Kimsuky threat group has deployed a new HTTPtroy backdoor targeting users in South Korea, highlighting a sophisticated cyber espionage campaign. This malware enables attackers to maintain persistent access and exfiltrate sensitive data from ...
1 month ago Darkreading.com Kimsuky

U.S DoJ Announces Nationwide Actions to Combat North Korean Remote IT Workers - The U.S. Department of Justice announced coordinated nationwide law enforcement actions on June 30, 2025, targeting North Korean remote information technology workers’ illicit revenue generation schemes that have defrauded American companies ...
5 months ago Cybersecuritynews.com

Microsoft links North Korean hackers to new FakePenny ransomware - Microsoft has linked a North Korean hacking group it tracks as Moonstone Sleet to FakePenny ransomware attacks, which have led to millions of dollars in ransom demands. While this threat group's tactics, techniques, and procedures largely overlapped ...
1 year ago Bleepingcomputer.com Kimsuky Lazarus Group LockBit Ransomhub

North Korean Hackers Using Dropbox & PowerShell Scripts To Infiltrate Organizations - Dubbed ‘DEEP#DRIVE’ by researchers at Securonix, the operation leverages phishing lures, obfuscated PowerShell scripts, and Dropbox’s infrastructure to bypass security defenses and exfiltrate sensitive data. A coordinated cyber ...
10 months ago Cybersecuritynews.com Kimsuky

North Korea APT Slapped With Cyber Sanctions After Satellite Launch - The US Department of the Treasury Office of Foreign Assets Control has announced it has sanctioned cyberespionage group Kimsuky for collecting intelligence on behalf of the Democratic People's Republic of Korea. The OFAC said the sanctions are ...
2 years ago Darkreading.com Kimsuky