Alert! Hacker Groups Exploiting New Malicious Chrome Extensions to Steal Sensitive Information

▌New Movements of the Kimsuky Group: Malicious Chrome Extension Steals Sensitive Information

Recently, the North Korea-linked threat actor known as the Kimsuky group has been exposed utilizing a new malicious Google Chrome extension as part of its ongoing intelligence-gathering operations, designed to steal sensitive information. In early March 2024, Kimsuky was observed conducting this malicious activity with an extension named TRANSLATEXT. Upon in-depth analysis, Lexfo Security Lab researchers discovered that the extension is capable of harvesting email addresses, usernames, passwords, cookies, and browser screenshots, featuring a highly targeted functional design. Kimsuky is a notorious hacking group from North Korea that has been active in the cyber world since 2012. They have meticulously planned and executed multiple cyber espionage campaigns and financially motivated attacks, using cunning and fluid tactics.

▌Kimsuky's New Tactic: Camouflage to Steal Information

As a sister group to the Lazarus Group and part of the Reconnaissance General Bureau (RGB), Kimsuky is also tracked under various other names such as APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet, Springtail, and Velvet Chollima. Behind these names lies the truth of their constantly changing identities and sustained malicious activities. In recent weeks, the group has also exploited a known security vulnerability in Microsoft Office (CVE-2017-11882) to propagate keyloggers, and has used job-themed lures in attacks targeting the aerospace and defense sectors. Their goals are highly clear: to deploy espionage tools with data collection and secondary payload execution capabilities to more effectively steal confidential information. Analysis of the backdoor program they recently used shows it allows threat actors to conduct basic reconnaissance and drop additional payloads, thereby taking over or remotely controlling victim machines. This activity has been named "Niki," and serves as a reminder for all users to step up their vigilance.

While it is currently unclear exactly how this newly discovered activity achieves initial access, the Kimsuky group is known to leverage spear-phishing and social engineering attacks to trigger the infection chain, with methods that are constantly escalating and difficult to guard against. The starting point of this attack was a ZIP archive claiming to be about Korean military history, containing two files: a Hangul Word Processor document and an executable file. Once a user inadvertently clicks to execute, a PowerShell script is retrieved from an attacker-controlled server to steal information. On March 7, 2024, a batch of files appeared on a GitHub account created on February 13, which briefly hosted the TRANSLATEXT extension named "GoogleTranslate.crx" before deleting it the following day. This indicates the Kimsuky group's intention to minimize exposure time and leverage this malware against specific individuals in a short timeframe. TRANSLATEXT disguises itself as Google Translate and contains JavaScript code capable of bypassing security measures of services like Google, Kakao, and Naver to steal email addresses, credentials, and cookies, capture browser screenshots, and exfiltrate data. Additionally, it is designed to receive instructions from Blogger Blogspot URLs to take screenshots of newly opened tabs and clear all cookies in the browser, posing a severe threat to users' cybersecurity.

▌Lexfo Verification Rules

Attack simulation rules targeting the methods employed by this hacking group have been added to the Lexfo Security Measurement and Verification Platform. You can search for keywords such as "keylogger", "APT43", "Kimsuky", "CVE-2017-11882", or "TRANSLATEXT" in the platform to obtain related attack simulation verification actions. This allows you to verify whether your security defense system can effectively counter attacks from this hacking group. The platform ensures your verification process is safe and harmless in an industry-unique manner.