Kimsuky’s Stealthy RDP Espionage Campaign

A newly uncovered cyber espionage campaign by North Korea-linked Kimsuky (aka Larva-24005) has been active since at least October 2023, targeting South Korea’s software, energy, and financial sectors, as well as global organizations.  The group used spear-phishing emails and exploited vulnerabilities like CVE-2017-11882 and CVE-2019-0708 (BlueKeep) to gain access, leveraging tools such as RDPWrap for persistent remote control. Once inside, they moved laterally and deployed keyloggers like KimaLogger to steal credentials and exfiltrate sensitive data to attacker-controlled C2 servers.