Dubbed ‘DEEP#DRIVE’ by researchers at Securonix, the operation leverages phishing lures, obfuscated PowerShell scripts, and Dropbox’s infrastructure to bypass security defenses and exfiltrate sensitive data. A coordinated cyber espionage campaign, attributed to North Korea’s state-sponsored Kimsuky group (APT43), has targeted South Korean businesses, government agencies, and cryptocurrency users since late 2024. The initial LNK file executes code that downloads two critical components: a decoy document (a fake work log or insurance form) and a secondary script (chrome.ps1) from Dropbox. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Here the security analysts at Securonix noted that the attackers used OAuth tokens to interact programmatically with Dropbox’s API, enabling automated uploads of stolen system data to predefined directories like /github/cjfansgmlans1_first/. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Securonix researchers attributed the campaign to Kimsuky based on infrastructure overlaps with prior operations like DEEP#GOSU and consistent targeting of South Korean entities. Once opened, the LNK file triggers a multi-stage PowerShell script designed to blend reconnaissance, payload delivery, and persistence mechanisms. A critical component of the attack involves Dropbox, which serves as both a payload repository and data exfiltration channel. The payload is decompressed, its headers modified to evade signature checks, and loaded directly into memory to execute a Main method—a fileless technique that avoids disk-based detection. The campaign begins with phishing emails distributing ZIP archives containing malicious Windows shortcut (.LNK) files disguised as legitimate Korean-language documents. Organizations are urged to monitor PowerShell activity, restrict script execution policies, and block unauthorized cloud storage access.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Feb 2025 16:40:05 +0000