Sparkling Pisces

Sparkling Pisces, also known as Kimsuky, APT43, Emerald Sleet, and THALLIUM, is a North Korean Advanced Persistent Threat (APT) group notorious for its intelligence collection efforts and use of cybercrime to fund espionage. Discovered by Unit 42 researchers, this group has been linked to multiple malware strains and campaigns, demonstrating a complex and ever-evolving infrastructure. The group's proficiency in advanced spear-phishing attacks and sophisticated cyberespionage operations underscores the serious threat it poses. In their latest research, the Unit 42 team identified two previously undocumented malware samples tied to Sparkling Pisces. These findings further illuminate the group's continuously evolving toolkit and intricate infrastructure. The newly discovered malware exhibits code and behavioral similarities with a variant described in ASEC's 2022 research. It shares several characteristics, including naming conventions of additional downloaded modules and logs, with Sparkling Pisces's KGHSpy backdoor, which was initially uncovered in 2020. Interestingly, the new malware uses an unknown Uniform Resource Identifier (URI) pattern not observed in any other associated Sparkling Pisces malware, indicating a potential evolution in their methodology. This development underlines the group's relentless pursuit of innovation and sophistication in their cyber-attack strategies. As such, understanding and monitoring Sparkling Pisces remains crucial in combating cyber threats and safeguarding digital assets.