"North Korea Policy Document Malware Attack" .. 'Koni Spear Phishing' Alert

Contains North Korea's 2020 Policies and Japan's 2020 Paralympics Details

[Asia Economy Reporter Jin-gyu Lee] East Security announced on the 17th that a new spear-phishing attack attempt by the advanced persistent threat (APT) group 'Koni' has been detected this year.

Spear-phishing is carried out by embedding malware in emails from trusted accounts to extract information from specific individuals or companies.

The recently discovered APT attack is presumed to have used a method attaching malicious DOC document files to emails. The two types of malicious document files used in the attack share the same file saver name, 'Georgy Toloraya,' and the internal code page was created based on the Korean language. Additionally, the document files are written in Russian and contain content related to North Korea's 2020 policies and Japan's 2020 Paralympics.

In particular, the file name of the document related to the Japan 2020 Paralympics impersonates a real charity organization, 'Kinzler Foundation,' as 'Kinzler Foundation for 2020 Tokyo Paralympic games.doc,' encouraging the email recipients to trust and open the document.

The malicious macro code used in the attack was created very similarly to the macros previously used by the Koni group, and the structure of the malicious document files was also found to be very similar.

If a user who receives the email clicks the 'Enable Content' button on the attached document containing Russian text or the Japan Paralympics-related content, the malware is executed. Once infected, the malware uploads key information from the user's PC system to a server designated by the attacker and enables remote control according to additional commands from the attacker, potentially leading to secondary damage.

Jong-hyun Moon, director of East Security, said, "Since there was a case last year where commonalities between the Koni and Kimsuky organizations were found, continuous research on these two groups is necessary," adding, "Koni's APT attacks using North Korea-related topics have been ongoing steadily, and since Koni's activities have been newly detected this year as well, we are strengthening focused monitoring."

This content was produced with the assistance of AI translation services.