Israeli Cybereason unveiled a new attack and espionage infrastructure of a North Korean attack group

The Israeli cyber company Cybereason has announced that it has unveiled a new attack and espionage infrastructure of a North Korean attack group called "Kimsuki".
The group spied on governments and private bodies in the United States, Europe, Japan, South Korea and Russia. The organizations it attacked include pharma and research companies that worked on the Corona vaccine, government security departments, the UN Security Council, journalists and human rights organizations.
According to Cyberisen, the North Koreans used new tools with advanced capabilities not yet seen and documented in the world to date, including those that recorded user actions on the computer, in order to steal passwords and sensitive information and then send what he stole to the group's encrypted servers. Despite the use of advanced tools, Kimsuki used simple social engineering techniques to infiltrate organizations, such as phishing emails.
Dahan added that "North Korean attack groups are also working against Israeli targets but since the tools we have uncovered today are new and unknown so far, the extent of the global damage has not yet been fully revealed and I believe we will find their footprints in other continents and countries soon. Kimsuki has a rich past of attacks Cyber ​​that began in 2012 with attacks on South Korea. In recent years, they have expanded their range of capabilities to advanced tools and their circle of activity in Asia to neighboring Japan and Russia, as well as to Europe and the United States.
Sabrizen was founded in 2012 by Lior Dib (CEO), Yossi Naar (CVO), and Yonatan Shetrim Amit (CTO). The company develops a system that collects information from all end stations in the organization, computers and servers, and analyzes their operations to identify stop real-time attacks.