Kimsuky__2020__VB2020-46.pdf

PwC's "To catch a Banshee" report profiles the North Korea-linked APT Kimsuky (aka Black Banshee), documenting its evolution and multiple concurrent espionage campaigns from 2018–2020. The presentation catalogs malware families (BabyShark, AppleSeed, FlowerPower, GoldDragon, WildCommand), encoding/packing/host patterns, C2 URL structures and server-side scripts, observed IPs/domains, timelines, and strategic targeting (South Korea, Japan, US policy, supranational bodies), providing technical IoCs and tradecraft indicators useful for detection and hunting.