BabyShark

BabyShark is a malicious software (malware) that has been linked to the North Korean Advanced Persistent Threat (APT) group known as Kimsuky, also referred to as Thallium and Velvet Chollima. This malware, written in Microsoft Visual Basic script, was first identified in November 2018 and was used primarily for cyber espionage against U.S.-based think tanks. A new toolset infrastructure associated with BabyShark was discovered between 2019 and 2020, which overlapped with another Kimsuky malware called ReconShark. The latter component is considered a variant of BabyShark, both being part of Kimsuky's arsenal for executing attacks via PowerShell or the Windows Command Shell after gaining initial access. The Nocturnus team tracked down the infrastructure and found overlaps with BabyShark and connections to other malware such as AppleSeed backdoor. The timing of these activities aligns with previous campaigns by the Kimsuky group, including those involving BabyShark and ReconShark. Recently, a threat actor exploited a critical vulnerability in the ConnectWise ScreenConnect remote access tool to deploy a malware strain similar to BabyShark, further cementing the association with the Kimsuky group. A new variant of this malware, dubbed ToddlerShark, has been observed. Researchers at Kroll named it due to its resemblance to BabyShark, but noted important advancements in its capabilities. Hackers have exploited recently disclosed ScreenConnect vulnerabilities to deploy ToddlerShark, which shares similarities with the reconnaissance tools ReconShark and BabyShark used by Kimsuky. In recent campaigns, Kimsuky has leveraged custom backdoors like ReconShark and BabyShark against government organizations, research centers, think tanks, and universities across North America, Europe, and Asia.