{
  "name": "APT attack discovered using Facebook and MS management console (Attack signs detected targeting Korea and Japan)",
  "slug": "apt-attack-discovered-using-facebook-and-ms-management-console-attack-signs-detected-targeting-korea-and-japan",
  "description": "A threat actor impersonated a North Korean human rights official on Facebook and approached targets. They shared malicious URLs disguised as documents. Microsoft OneDrive cloud service was used to host the malicious MSC file, which communicated with C2 servers and deployed Reconshark malware associated with the Kimsuky group. Signs of similar attacks targeting Japan were also observed.",
  "published": "2024-05-21T09:15:15+00:00",
  "created_at": "2024-05-21T09:15:15+00:00",
  "modified_at": "2024-05-21T09:37:33+00:00",
  "created_at_opencti": "2024-05-21T09:15:15+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-21",
    "apt",
    "kimsuky",
    "northkorea"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "52.177.14.24"
      },
      {
        "id": "",
        "name": "5.9.123.217"
      },
      {
        "id": "",
        "name": "199.59.243.225"
      },
      {
        "id": "",
        "name": "162.0.209.91"
      },
      {
        "id": "",
        "name": "162.0.209.27"
      },
      {
        "id": "",
        "name": "http://worldinfocontact.club/111/kfrie/cow.php"
      },
      {
        "id": "",
        "name": "http://worldinfocontact.club/111/d.php"
      },
      {
        "id": "",
        "name": "http://rfa.ink/bio/d.php?na=vbtmp"
      },
      {
        "id": "",
        "name": "http://rfa.ink/bio/d.php?na=battmp"
      },
      {
        "id": "",
        "name": "http://rapportdown.lol/rapport/com/ca.php?na=video.gif"
      },
      {
        "id": "",
        "name": "http://rapportdown.lol/rapport/com/"
      },
      {
        "id": "",
        "name": "http://nuclearpolicy101.org/wp-admin/includes/lee/leeplug/cow.php"
      },
      {
        "id": "",
        "name": "http://nuclearpolicy101.org/wp-admin/includes/0603/d.php?na="
      },
      {
        "id": "",
        "name": "http://nuclearpolicy101.org/wp-admin/includes/0421/d.php?na=vbtmp"
      },
      {
        "id": "",
        "name": "http://mitmail.tech/gorgon/ca.php?na=video.gif"
      },
      {
        "id": "",
        "name": "http://mitmail.tech/gorgon/ca.php"
      },
      {
        "id": "",
        "name": "http://joongang.site/pprb/sec/d.php"
      },
      {
        "id": "",
        "name": "http://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx"
      },
      {
        "id": "",
        "name": "http://ielsems.com/romeo/d.php?na=vbtmp"
      },
      {
        "id": "",
        "name": "http://dusieme.com/panda/d.php?na=vbtmp"
      },
      {
        "id": "",
        "name": "http://ielsems.com/panda"
      },
      {
        "id": "",
        "name": "http://dusieme.com/panda/TBS"
      },
      {
        "id": "",
        "name": "http://dusieme.com/hwp/d.php?na=sched"
      },
      {
        "id": "",
        "name": "http://dusieme.com/js/cic0117/ca.php?na=dot_emsi.gif"
      },
      {
        "id": "",
        "name": "http://brandwizer.co.in/green_pad/wp-content/plugins/custom-post-type-marker/ayaka"
      },
      {
        "id": "",
        "name": "http://brandwizer.co.in/green_pad/wp-content/plugins/custom-post-type-maker/kohei/r.php"
      },
      {
        "id": "",
        "name": "http://brandwizer.co.in/green_pad/wp-content/plugins/custom-post-type-maker/essay/d.php?na=battmp"
      },
      {
        "id": "",
        "name": "http://brandwizer.co.in/green_pad/wp-content/plugins/custom-post-type-"
      },
      {
        "id": "",
        "name": "http://beastmodser.club/sil/0304/d.php?na"
      },
      {
        "id": "",
        "name": "http://brandwizer.co.in/green_pad/wp-"
      },
      {
        "id": "",
        "name": "http://beastmodser.club/sil/0304/VOA_Korea.docx"
      },
      {
        "id": "",
        "name": "worldinfocontact.club"
      },
      {
        "id": "",
        "name": "rapportdown.lol"
      },
      {
        "id": "",
        "name": "nuclearpolicy101.org"
      },
      {
        "id": "",
        "name": "makeoversalon.net.in"
      },
      {
        "id": "",
        "name": "ielsems.com"
      },
      {
        "id": "",
        "name": "joongang.site"
      },
      {
        "id": "",
        "name": "dusieme.com"
      },
      {
        "id": "",
        "name": "brandwizer.co"
      },
      {
        "id": "",
        "name": "brandwizer.co.in"
      },
      {
        "id": "",
        "name": "beastmodser.club"
      },
      {
        "id": "",
        "name": "yonsei.lol"
      },
      {
        "id": "",
        "name": "mitmail.tech"
      },
      {
        "id": "",
        "name": "2f7f3a86a868f6c5a85fb12fe028fd254cd9622075b179923187461c72d6aea0"
      },
      {
        "id": "",
        "name": "2209f27b08fc10118ef03ca983f1bbdff3ca2371a02382f9f34f64fdcae07ffe"
      },
      {
        "id": "",
        "name": "9c6f6db86b5ccdda884369c9c52dd8568733e126e6fe9c2350707bb6d59744a1"
      }
    ],
    "malware": [
      {
        "id": "6c57d5f0-75ed-4f31-9c86-d9434370cff4",
        "name": "reconshark",
        "slug": "reconshark"
      }
    ],
    "intrusion_sets": [
      {
        "id": "294d962a-b24e-446b-8e2d-3706cb1316b3",
        "name": "Kimsuky",
        "slug": "kimsuky"
      }
    ],
    "attack_patterns": [
      {
        "id": "4d36ebe8-4925-419a-bdd5-73f6427a975d",
        "name": "T1064"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "af9ed2e3-4663-4723-beab-c606ddc312e0",
        "name": "T1543"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Japan"
      }
    ]
  },
  "external_refs": [
    "https://www.genians.co.kr/blog/threat_intelligence/facebook",
    "https://otx.alienvault.com/pulse/664c824398761b028f8bcb9d"
  ]
}