Kimsuky Group activities in the first half of 2021

A kind of bait:
d7b717134358bbeefc5796b5912369f0
6a614ca002c5b3a4d7023faffc0546e1
bce51419fae8acbeff3149ca53f8baad
49a04c85555b35f998b1787b325526e6
c9f23b6ee1ba97c753892e6c103521d6
5b2355014f72dc2714dc5a5f04fe9519
8ca84c206fe8436dcc92bf6c1f7cf168
d725efd437d26e01e3b64e722929c01e
0d36f4f5a1f7bc7d89fbda02be7c2336
86c462b8ceffbc10018df2c32e024b29
208a3b4565d3041d09448a23a80edf1c

http://connectter[.]atwebpages[.]com/2612/download[.]php?
http://majar[.]medianewsonline[.]com/0812/1[.]php?
http://majar[ .]medianewsonline[.]com/0812/1[.]php?
http://eucie09111[.]myartsonline[.]com/0502/v[.]php?
http://hanlight[.]mygamesonline[.] org/2403/v[.]php?
http://ftcpark59[.]getenjoyment[.]net/1703/v[.]php?


Two types of bait:
dfbe17d9dfa3f3bb715e1d8348bd1f50
dc5fa08c7e2bb959042f5572c91ada5e
1269e2b00fd323a7748215124cb058cd
9d3b4e82d2c839ffc2887946fb204615
5973ba270e9b5ea57c138245ffc39552
af3288ed7853865d562ccd1f48fa4a16
199674e87f437bdbd68884b155346d25


http://manct[.]atwebpages[.]com/ck/uy[.]txt
http://fabre[.]myartsonline[.]com/ys/ha[.]txt
http://rukagu[.] mypressonline[.]com/le/yj[.]txt
http://quarez[.]atwebpages[.]com/ny/ui[.]txt
http://quarez[.]atwebpages[.]com/ny/ post[.]php
http://quarez[.]atwebpages[.]com/ds/le[.]txt
http://waels[.]onlinewebshop[.]net/st/wa[.]txt
http:/ /pootball[.]medianewsonline[.]com/ro/ki[.]txt



Three types of bait:

04a0505cc45d2dac4be9387768efcb7c
d3a317dd167cfa77c976fa9c86c24982
d8e817abd5ad765bf7acec5d672cbb8d
4886f89546c422f5e04c2da33090a201
0a68d6a3d0aa9c5a3a4485d314ea8372
c6437d685f4a489c867b4d2b68f07f1a
36ad6b5775ac550a36f56467051d2c03
ec3f771c71a24c165697e26e136daa4a
9ee9dacd6703c74e959a70a18ebb3875
1670bb091dba017606ea5e763072d45f
21b72a6ed58db07a7f7c16372c3422e2
41aba3f7a154fb209beba0e36e6ef3ab
68a1cc84de7d5802b7251786a8a5da0c
a9b6cf8d8d0a67da4eea269dab16fe99
fe4dd316363d3631c83c2995dd3775f4

http://yanggucam[.]designsoup[.]co[.]kr/user/views/board/skin/secret/css/list[.]php?query=1

http://samsoding[.]homm7[.]gethompy[.]com/plugins/dropzone/min/css/list[.]php?query=1

http://www[.]mechapia[.]com/_admin/nicerlnm/web/style/list[.]php?query=1

http://miracle[.]designsoup[.]co[.]kr/user/views/resort/controller/css/update/list[.]php?query=1

http://cwda[.]co[.]kr/theme/basic/skin/new/basic/update/list[.]php?query=1

http://cwda[.]co[.]kr/theme/basic/skin/new/basic/update/Normal[.]dotm?q=6

http://heritage2020[.]cafe24[.]com/plugin/kcpcert/bin/list[.]php?query=1

http://www[.]inonix[.]co[.]kr/kor/page/product/_notes/list[.]php?query=1

http://www[.]inonix[.]co[.]kr/kor/page/product/_notes/tmp/?q=6

http://beilksa[.]scienceontheweb[.]net/cookie/select/log/list[.]php?query=1

http://beilksa[.]scienceontheweb[.]net/cookie/select/log/tmp?q=6

http://www[.]inonix[.]co[.]kr/kor/board/widgets/mcontent/skins/tmp?q=6

http://koreacit[.]co[.]kr/skin/new/basic/update/temp?q=6

https://reform-ouen[.]com/wp-includes/css/dist/nux/dotm/dwn[.]php?id=0119

http://www[.]anpcb[.]co[.]kr/plugin/sns/facebook/src/update/normal[.]dotm?q=6

http://beilksa[.]scienceontheweb[.]net/cookie/select/log/tmp?q=6



Four types of bait:
0821884168a644f3c27176a52763acc9
95c92bcfc39ceafc1735f190a575c60c

http://wbg0909[.]scienceontheweb[.]net/0412/download[.]php?
https://smyun0272[.]blogspot[.]com/2021/06/dootakim[.]html
http://alyssalove [.]getenjoyment[.]net/0423/v[.]php?


Five types of decoys: New decoy document testing activities: e3e40b3eaefeb0c63dd449087a8988efFE3AD944D07B66C83DC433C39FC054F4D79C92CC5AB70B61B2E174256577EA3A9E0B68D23D36A6D53276BA204BD8377120DE780D36A6D276BA204BD8377120F380EBF380F9EBF380F9CF9F3,7,7,F,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,，,,，,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,:::::::::::::::::workthan::::::::::::; : ;; : ;; : ;; : ;; : ;; : ;;;







https://1ive[.]me/ww/mac/0526_sim/d[.]php?na=version[.]gif
https://onedrive[.]live[.]com/?authkey=%21APtP1%2DAyXU4q3Gg&cid =EA63197CF6E2BF62&id=EA63197CF6E2BF62%21171&parId=root&o=OneUp
https://worldinfocontact[.]club/111/mac3[.]php?na="username"
https://worldinfocontact[.]club/111/bill/cow[. ]php?op=1drop[.]bat
https://worldinfocontact[.]club/111/bill/expres[.]php?op=2
http://nuclearpolicy101[.]org/wp-admin/includes/0421 /d[.]php?na=dot[.]gif
http://nuclearpolicy101[.]org/wp-admin/includes/0421/d[.]php?na=vbtmp



hancom

15ec5c7125e6c74f740d6fc3376c130d

3ecc65085a91044a119abce4f0c0d4de

ec19cd77170b6ac8772c5799fdd88852

11ac8609d64e5a5ade83eff92e4f1314

1d30dfa5d8f21d1465409b207115ded6

37e4865de72c3169d591e16ef8823676

e69294040dab044805c9d7c47fef4844

cf5815a1f635dca148ccffeb074b64d5

c9dae2b42f0b28631dc314a74fa2177f

0629fd238259d7df7aa22ca82ac6b93e

425f291cbaee9b44214057642db271a5

0e998937644007904f27a1eaffe32df5

7a67b8c387f24b782e46601634165681

6ec77913e6a359ee4e62909e28c08f1d

2399df3a222032c188a22df52a49384a

d73239230625afd2d9fa6cce1c6c022c

4a139f6888790f059ff5e19056ca5664

71e480edcb51a02b8460ccc9b2dfa272(doc)

72d43ff8f9ee0819e96ed7fd7d9a551a(wieb.dat)

7f8a4e0dca2e18121af505d9198d81d1(cvwiq.zip)

523b3401b0fb0e8aec9be70f57686840(hancom_vmp_zip)

4a139f6888790f059ff5e19056ca5664(hancom_vmp)

http://kr2959[.]atwebpages[.]com/view.php?id=2

http://kr2959[.]atwebpages[.]com/view[.]php?id=21504

klsa[.]onlinewebshop.net



Attacker's mailbox:

flower9801@hanmail.net



It may be a stolen mailbox/ID:

nk_biz_forum

applebox31@daum.net

daeknmoon@daum.net

shin.kyungjin@daum.net

article: https://mp.weixin.qq.com/s/og8mfnqoKZsHlOJdIDKYgQ