DEEP#DRIVE: Kimsuky Exploits Cloud Platforms for Stealthy Cyber Espionage

The DEEP#DRIVE cyber campaign, attributed to Kimsuky, a North Korean state-sponsored hacking group, is actively targeting South Korea’s business, government, and cryptocurrency sectors. The operation relies heavily on PowerShell scripts for delivering malware, gathering intelligence, and executing follow-up attacks. A notable tactic in this campaign is the use of Dropbox, which serves both as a delivery channel for malicious payloads and as a storage point for exfiltrated system data.