North-sponsored cyberattacks utilize KakaoTalk to distribute malware

A North Korea-linked hacking group has used stolen KakaoTalk accounts to spread malware in a series of recent cyberattacks, highlighting a new distribution tactic, a report showed Monday.

Konni, the hacking group tied to Kimsuky and other Pyongyang-sponsored groups, was found to have recently carried out an advanced persistent threat (APT) campaign using spear-phishing emails and compromised KakaoTalk accounts to infect victims' systems, according to the report published by Genians Security Center, a South Korean cybersecurity institute.

The group sent spear-phishing emails disguised as notices appointing the recipient as a North Korean human rights lecturer, with a malicious online link included to gain remote access to the victim's personal computer. Spear phishing is a type of phishing attack that targets a specific individual, group or organization.

The report noted that KakaoTalk's PC software was used, forcing the victim to serve as an intermediary for further attacks.

After remaining undetected on the system for some time, the actors gain access to the victim's KakaoTalk contact list and redistribute malicious files through the compromised accounts.

"This makes the threat particularly serious, as it goes beyond simple spear-phishing and represents a propagating APT attack that combines trust-based propagation with abuse of account sessions," the report said.

Yonhap