2023_Group123_threat_inteligence_report_BitB.pdf

This Genians Security Center report documents a targeted BitB (Browser-in-the-Browser) phishing campaign impersonating the LiNK NGO to steal credentials from North Korea-related activists and organizations. The attackers used SSO-style popups and short links that redirect to a fake libertynorthkorea.org site; investigation links multiple domains, IPs and MD5 hashes to APT37 infrastructure and identifies follow-on LNK/ROKRAT malware and beaconing. The report includes IoCs (domains, IPs, hashes), detection tips for BitB popups, and remediation/detection recommendations including EDR policies.