(3) Kimsuky is targeting an arms manufacturer in Europe. | LinkedIn

On 16 May 2024 researchers attributed a spear-phishing campaign to the North Korean APT Kimsuky targeting a Western European weapons manufacturer; the attacker delivered a malicious .jse attachment that decodes a benign PDF as a visual lure and a double-base64 encoded x64 DLL espionage payload which establishes persistence (service "CacheDB" and Run registry), communicates with C2 infrastructure (notably download.uberlingen.com -> 94.131.120.80 and related hosts/IPs), and supports file enumeration, process listing, screenshots, remote execution and data exfiltration. The report includes file hashes, network indicators, a YARA rule, decrypted runtime strings and recommended IoCs for detection and hunting.