Kimsuky__2020__TLP-WHITE_AA20-301A_North_Korean_APT_Focus_Kimsuky.pdf

This CISA/FBI/CNMF joint advisory details the tactics, techniques, and procedures of the North Korean APT "Kimsuky," including spearphishing lures, BabyShark VBS and other implants, credential harvesting (browser extension abuse, keyloggers, ProcDump), persistence (registry run keys, services, malicious browser extensions), process injection and privilege escalation, modified TeamViewer for C2, observed domains and file/path IOCs, and mitigations such as MFA and phishing defenses.