Kimsuky__2021__as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf

CloudDragon (linked to Kimsuky/APT activity) is a multi-year, multi-platform APT campaign that uses supply-chain compromise, targeted phishing (proxy-mirror), and malware families (JamBog, BabyShark, TroiBomb, RoastMe, DongMulRAT) to exfiltrate data and steal cryptocurrency; the report documents infrastructure (domains, IPs), sample hashes, code snippets showing credential/seed harvesting and SMS exfiltration, and an August–October 2020 incident impersonating a hardware wallet update to steal mnemonic seeds.