Kimsuky, alias Mystery Baby, Baby Coin, Smoke Screen, Black Banshe, etc., is tracked internally by Qi’anxin as APT-Q-2. The APT group was publicly disclosed in 2013, with attack activity dating as far back as 2012.
Kimsuky’s main target for attacks has been South Korea, involving defense, education, energy, government, healthcare, and think tanks, with a focus on classified information theft. The group typically delivers malware using social engineering, spearmail, and puddle attacks, and has a wide range of attack tactics, with weapons for both Windows and Android platforms. Summary of events A batch of malware similar to Kimsuky’s historical samples was recently discovered by the Qi’anxin Threat Intelligence Center. One of the samples releases software signed by Korean software vendor BlueMoonSoft to confuse victims.
Read more…
Source: Qi’anxin Threat Intelligence Center.
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Medical records, SSNs, and bank details exposed in CareCloud data breach
August 21, 2026
Healthcare technology giant CareCloud has confirmed that a data breach earlier this year impacted more than 3.75 million people, making it one of the largest healthcare data incidents disclosed this year. The New Jersey-based company, which provides electronic health record (EHR) and practice management services, first flagged the intrusion in an SEC filing back in March, but the true scope ...
- Identity abuse through trusted communication channels
August 20, 2026
Identity has become a primary security boundary for most organizations, reducing the ability to solely trust other boundaries once associated with corporate networks. Users authenticate to cloud services using enterprise identities that provide access to collaboration platforms, business applications and sensitive data. With the adoption of software-as-a-service (SaaS) on the rise, people are shifting to ...
- CareCloud confirms 3.7M patients had their medical records stolen in data breach
August 19, 2026
Hackers have stolen the personal information and medical records of more than 3.75 million people in a data breach at health data giant CareCloud, the company has confirmed with federal regulators. The disclosure marks the first confirmation of the scale of the data breach, which is now confirmed to be the fifth-largest theft of health ...
- Defending against an active threat to Siemens S7 Series PLCs
August 19, 2026
This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as ...
- ‘Proactive SIM’ cards can hijack smartphones, IoT devices and even EV chargers
August 18, 2026
A malicious SIM card can instruct the device it sits in to run commands of an attacker’s choosing, and on the cellular modules embedded in electric vehicle chargers, industrial routers, and car telematics units, essentially allowing it to take the entire device over. Researchers from the University of Birmingham and the German security firm Fuzzware demonstrated ...
- Mitigating large-scale credential attacks
August 18, 2026
Identity has effectively become the new perimeter, where cybercriminals are increasingly choosing to log in rather than break in. To accomplish this, attackers frequently gather previously leaked username and password pairs. Gathering these credentials can then allow them to pivot to password spraying against services exposed to the internet, gaining credentials for other products and ...