Kimsuky__2023__ATIP_2023_May_Threat-Trend-Report-on-Kimsuky-Group.pdf

This AhnLab ASEC monthly threat trend report details increased Kimsuky activity in May 2023, documenting three primary attack families (FlowerPower, RandomQuery, AppleSeed), new TLD-based C2 infrastructure, script variants for detection evasion, use of bait files targeting cryptocurrency personnel, distribution of ngrok from actor C2 for tunneling, and provides extensive IOCs (hashes, domains, file paths) and detection names for response.