THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

THE KIMSUKY SYSTEM
The Kimsuky malware complex was originally detailed in a report from Kaspersky (14) in 2013 and has been an
active component of the South Korean threat landscape since then. Ahnlab reported a new campaign in Feb 2014
(15), and an intrusion attempt into South Korean nuclear facilities in Dec 2014 was also identified to involve
Kimsuky (16).
The Kimsuky malware is different in structure from the Destover complex. It uses different encoding schemes and
algorithms than Destover, and email and FTP is used for C&C communication and exfiltration.
Similar to Destover, Kimsuky has used HWP exploits as infection vector. A number of samples rely on
vulnerabilities in the old OLE2-based HWP file format. However, they have not, as far as we have seen, used the
recent CVE-2015-6585 HWPX vulnerability which has been used to plant at least three variants of Destover.
There are some similarities in modus operandi, such as
• Encoded API usage.
• Frequent code hand-modifications between samples
• Malware installed as services
• Taunting the victim in public fora
• Posing as hacktivist groups (17)
• Publication of stolen data (17)
Based on the available data we cannot say that the Kimsuky-based campaigns are connected to the DarkSeoul
group.
THE BLACKMINE SYSTEM
Blackmine is a South Korean focused malware campaign detailed by Ahnlab (18).
The payload malware in question is a data harvester and uploader, which also allows for download of more
malware. In the same way as Kimsuky, there are some similar approaches with Destover – the usage of obfuscated
API names for example – but also enough differences to say that Blackmine probably has not originated from the
same codebase. Ahnlab does however state that they see these groups as possibly correlated.