Microsoft Word - 02. ATIP_2022 Threat Trend Report on Kimsuky_20220227.docx

AhnLab's 2022 Threat Trend Report on the Kimsuky group documents sustained and evolving APT activity: prolific FlowerPower and AppleSeed campaigns, customized Quasar/xRAT variants, exploitation of Follina (CVE-2022-30190), use of Korean blogs and misconfigured C2 servers (which exposed artifacts), expanded IOCs (~297 FQDNs, IPs, MD5s), and a shift toward fileless techniques and information-stealing capabilities targeting universities, broadcasters, think tanks and similar organizations.