kimsuky-2023-03-20-joint-cyber-security-advisory.pdf

Joint advisory from Germany's BfV and South Korea's NIS warns that the APT actor KIMSUKY (aka Thallium/Velvet Chollima) is conducting spear-phishing campaigns that deploy malicious Chromium browser extensions to steal Gmail contents and abuse Google Play synchronization to install malicious Android apps; the report includes TTPs, IoCs (C2 domains, file hashes, app identifiers), and recommended mitigations.