Kimsuky’s New Golang Stealer ‘Troll’ and ‘GoBear’ Backdoor Goal South Korea

Feb 08, 2024NewsroomCyber Espionage / Malware

The North Korea-linked nation-state actor often called Kimsuky is suspected of utilizing a beforehand undocumented Golang-based info stealer known as Troll Stealer.

The malware steals “SSH, FileZilla, C drive recordsdata/directories, browsers, system info, [and] display screen captures” from contaminated programs, South Korean cybersecurity firm S2W mentioned in a brand new technical report.

Troll Stealer’s hyperlinks to Kimsuky stem from its similarities to identified malware households, akin to AppleSeed and AlphaSeed malware which were attributed to the group.

Kimsuky, additionally tracked beneath the names APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet (beforehand Thallium), Nickel Kimball, and Velvet Chollima, is well-known for its propensity to steal delicate, confidential info in offensive cyber operations.

In late November 2023, the risk actors had been sanctioned by the U.S. Treasury Division’s Workplace of International Belongings Management (OFAC) for gathering intelligence to additional North Korea’s strategic goals.

The adversarial collective, in current months, has been attributed to spear-phishing assaults focusing on South Korean entities to ship a wide range of backdoors, together with AppleSeed and AlphaSeed.

S2W’s newest evaluation reveals using a dropper that masquerades as a safety program set up file from a South Korean firm named SGA Options to launch the stealer, which will get its identify from the trail “D:/~/repo/golang/src/root.go/s/troll/agent” that is embedded in it.

“The dropper runs as a respectable installer alongside the malware, and each the dropper and malware are signed with a legitimate, respectable D2Innovation Co.,LTD’ certificates, suggesting that the corporate’s certificates was really stolen,” the corporate mentioned.

A stand-out function of Troll Stealer is its skill to pilfer the GPKI folder on contaminated programs, elevating the likelihood that the malware has been put to make use of in assaults focusing on administrative and public organizations within the nation.

Given the absence of Kimsuky campaigns documenting the theft of GPKI folders, it has raised the likelihood that the brand new conduct is both a shift in ways or the work of one other risk actor carefully related to the group that additionally has entry to the supply code of AppleSeed and AlphaSeed.

There are additionally indicators that the risk actor could also be concerned with a Go-based backdoor codenamed GoBear that is additionally signed with a respectable certificates related to D2Innovation Co., LTD and executes directions acquired from a command-and-control (C2) server.

“The strings contained within the names of the capabilities it calls have been discovered to overlap with the instructions utilized by BetaSeed, a C++-based backdoor malware utilized by the Kimsuky group,” S2W mentioned. “It’s noteworthy that GoBear provides SOCKS5 proxy performance, which was not beforehand supported by the Kimsuky group’s backdoor malware.”