Reconshark

ReconShark is a new malware variant deployed by the North Korea-linked Advanced Persistent Threat (APT) group, Kimsuky. This tool has been observed in an ongoing campaign, used as an infostealer-downloader and is a new iteration of the group's custom BabyShark malware family. The ReconShark tool is delivered through command-and-control sites such as staradvertiser[.]store, which are known to be controlled by Kimsuky. The group typically engages targets in conversation, delivering a spoofed URL to a Google document that redirects to a malicious website designed to capture Google credentials, or a weaponized Office document that executes the ReconShark reconnaissance malware. Kimsuky has also been exploiting recently disclosed ScreenConnect vulnerabilities to deploy ToddlerShark, another new variant of malware overlapping with ReconShark and BabyShark. These tools have been used in various espionage campaigns against government organizations, research centers, think tanks, and universities across North America, Europe, and Asia. Kroll's analysts believe ToddleShark is a new version of Kimsuky's BabyShark and ReconShark backdoors, previously seen targeting similar organizations in the United States, Europe, and Asia. For certain targets who engage with the attackers, Kimsuky sends weaponized password-protected Word documents that deploy a reconnaissance malware payload called ReconShark. This program probes systems for the presence of known security software and collects information about the target's computer, planning for a future attack. The archive was used to deploy the ReconShark reconnaissance tool, marking the first time this malware, identified as a reconnaissance instrument, has been distributed by the attackers.