_Co-Authored by:_ **TLP:CLEAR** Product ID: CSA-20230601-1 # North Korea Using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media ## SUMMARY The Federal Bureau of Investigation (FBI), the U.S. Department of State, and the National Security Agency (NSA), together with the Republic of Korea’s National Intelligence Service (NIS), National Police Agency (NPA), and Ministry of Foreign Affairs (MOFA), are jointly issuing this advisory to highlight the use of social engineering by Democratic People’s Republic of Korea (DPRK a.k.a. North Korea) state-sponsored cyber actors to enable computer network exploitation (CNE) globally against individuals employed by research centers and think tanks, academic institutions, and news media organizations. These North Korean cyber actors are known to conduct spearphishing campaigns posing as real journalists, academics, or other individuals with credible links to North Korean policy circles. The DPRK employs social engineering to collect intelligence on geopolitical events, foreign policy strategies, and diplomatic efforts affecting its interests by gaining illicit access to the private documents, research, and communications of their targets. ## BACKGROUND North Korea’s cyber program provides the regime with broad intelligence collection and espionage capabilities. The Governments of the United States and the Republic of Korea (ROK a.k.a. South Korea) have observed sustained information-gathering efforts originating from these North Korean cyber actors. North Korea’s primary military intelligence organization, the Reconnaissance General Bureau (RGB), which has been sanctioned by the United Nations Security Council, is primarily responsible for this network of actors and activities. We assess the primary goals of the DPRK regime’s cyber program include maintaining consistent access to current intelligence about the United States, South Korea, and other countries of interest to impede any political, military, or economic threat to the regime’s security and stability. Currently, the U.S. and ROK Governments, and private sector cyber security companies, track a specific set of DPRK cyber actors conducting these large-scale social engineering campaigns as **_Disclaimer: This document is marked TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR_** _when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and_ _procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be distributed_ _[without restriction. For more information on the Traffic Light Protocol, see https://www.cisa.gov/tlp.](https://www.cisa.gov/tlp)_ ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Kimsuky, Thallium, APT43, Velvet Chollima, and Black Banshee. Kimsuky is administratively subordinate to an element within North Korea’s RGB and has conducted broad cyber campaigns in support of RGB objectives since at least 2012. Kimsuky actors’ primary mission is to provide stolen data and valuable geopolitical insight to the North Korean regime. Some targeted entities may discount the threat posed by these social engineering campaigns, either because they do not perceive their research and communications as sensitive in nature, or because they are not aware of how these efforts fuel the regime’s broader cyber espionage efforts. However, as outlined in this advisory, North Korea relies heavily on intelligence gained by compromising policy analysts. Further, successful compromises enable Kimsuky actors to craft more credible and effective spearphishing emails that can be leveraged against more sensitive, higher-value targets. The authoring agencies believe that raising awareness of some of these campaigns and employing basic cyber security practices may frustrate the effectiveness of Kimsuky spearphishing operations. This advisory provides detailed information on how Kimsuky actors operate; red flags to consider as you encounter common themes and campaigns; and general mitigation measures for entities worldwide to implement to better protect against Kimsuky’s CNE operations. **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **If you believe you have been targeted in one of these spearphishing campaigns, whether or not** **it resulted in a compromise (particularly if you are a member of one of the targeted sectors),** **[please file a report with www.ic3.gov and reference #KimsukyCSA in the incident description.](https://www.ic3.gov/)** **Please include as much detail as you can about the incident including the sender email address** **and the text of the email message, specifying any links/URLs/domains. Please specify whether** **you responded to the email, clicked on any links, or opened any attachments. Please retain the** **original email and attachments in case you are contacted by an investigator for further** **information.** - Please visit **[www.ic3.gov](https://www.ic3.gov/)** and use #KimsukyCSA in your submission. - The U.S. Government also encourages victims to report suspicious activities, including any suspected DPRK cyber activities, to local FBI field offices. - For the ROK government, you can report suspicious activities to the National Intelligence Service (www.nis.go.kr, 111), the National Police Agency (ecrm.police.go.kr, 182), or the Korea Internet & Security Agency (boho.or.kr, 118) ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA ## KIMSUKY OPERATIONS: SOCIAL ENGINEERING In a cybersecurity context, social engineering is a broad term referring to the use of deception to exploit human error and manipulate a target into unwittingly exposing confidential or sensitive information for fraudulent purposes. DPRK cyber actors employ social engineering techniques to enable much of Pyongyang’s malicious CNE. Among social engineering techniques, Kimsuky actors use spearphishing—or the use of fabricated emails and digital communications tailored to deceive a target—as one of their primary vectors for initiating a compromise and gaining access into a target’s devices and networks. For over a decade, Kimsuky actors have continued to refine their social engineering techniques and made their spearphishing efforts increasingly difficult to discern. A Kimsuky spearphishing campaign begins with broad research and preparation. DPRK cyber Input Settings – Set specific input. actors often use open- Caution: Check input settings for errors. source information to identify potential targets of Sender Name value and then tailor their online personas to appear Sender Address more realistic and Recipient Address appealing to their victims. Subject The Kimsuky actors will Date and Time create email addresses Destination Link that resemble email addresses of real Creator Name individuals they seek to Sample of a program for generating DPRK spearphishing emails. impersonate and generate domains that host the malicious content of a spearphishing message. DPRK actors often use domains that resemble common internet services and media sites to deceive a target. - For example, Kimsuky actors are known to impersonate well-known news outlets and journalists using a domain such as “@XYZkoreas.news” spoofing a real news station while actual emails from the news service appear as “@XYZnews.com.” - DPRK cyber actors commonly take on the identities of real people to gain trust and establish rapport in their digital communications. Kimsuky actors may have previously compromised the email accounts of the person whom they are impersonating. This allows the actors to search for targets while scanning through compromised emails, with a particular focus on workrelated files and personal information pertaining to retirees, social clubs, and contact lists. They craft convincing spearphishing emails by repurposing the person’s email signature, contact list, and past email exchanges. DPRK cyber actors are also known to compromise Input Settings – Set specific input. Caution: Check input settings for errors. Sender Name Sender Address Recipient Address Subject Date and Time Destination Link Creator Name ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA email accounts belonging to foreign policy experts and subsequently create a secondary email account, using the email account and identity of the expert to communicate with other significant targets. - In other cases, a Kimsuky actor will use multiple personas to engage a target; one persona to conduct initial outreach and a second persona to follow-up on the first engagement to distract a potential victim from discerning the identity of the original persona. Another tactic is to “resend” or “forward” an email from a source trusted by a target. - The initial phishing email occasionally contains a malicious link or document, often purporting to be a report or news article. These attached malicious documents are frequently passwordprotected, which helps them evade detection by antivirus software and other security measures. However, more often, the initial spearphishing email does not contain any malicious links or attachments and is instead intended to gain the trust of the victim. - Once DPRK cyber actors establish engagement with a target, the actors attempt to compromise the account, device, or network belonging to the target by pushing malicious content in the form of a malicious macro embedded within a text document. This document is either attached directly to the email, or stored in a file hosting service, such as Google Drive or Microsoft OneDrive. These malicious macros, when enabled, quietly establish connections with Kimsuky command and control infrastructure, and result in the provision of access to the target’s device. - In some cases, Kimsuky actors have developed “spoofed” or fake but realistic versions of actual websites, portals, or mobile applications, and directed targets to input credentials and other information that are harvested by the DPRK. Compromise of a target account can lead to persistent access to a victim’s communications, often through a malware used by Kimsuky [actors called BabyShark. Kimsuky actors have also been known to configure a victim’s email](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a) account to quietly auto-forward all emails to another actor-controlled email. Notably, victim responses to spearphishing lures also provide Pyongyang with the added benefit of insight into foreign policy circles. This covert collection against the community of DPRK watchers is probably of high value to the Kim regime and provides another channel of information on top of what it gains through computer network operations. Although all DPRK advanced persistent threat groups employ social engineering techniques, the campaigns and themes described in this advisory are specific to Kimsuky. **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA ## RED FLAG INDICATORS Sector targets should be aware of the following activity that may be indications or behaviors of malicious DPRK cyber actors. - Initial communications are often seemingly innocuous with no malicious links/attachments; follow-on communications usually contain malicious links/documents to facilitate exploitation of a computer or network. - Email content may include real text of messages recovered from previous victim engagement with other legitimate contacts. - Emails in English may sometimes have awkward sentence structure and/or incorrect grammar. - Email content may contain a distinct Korean dialect exclusively used in North Korea. - Victims/targets with both direct and indirect knowledge of policy information i.e., U.S. and ROK government employees/officials working on North Korea, Asia, China, Southeast Asia matters; U.S. and ROK government employees with high clearance levels; and members of the military, are approached with common themes and questions as referenced in this advisory. - Email domains look like a legitimate news media site, but do not match the domain of the company’s official website. The domains also may be identified as such in open-source malware repositories like Virus Total. - Spoofed email accounts have subtle incorrect misspellings of the names and email addresses of the legitimate ones listed in a university directory or an official website. - Malicious documents require the user to click “Enable Macros” to view the document. - Actors are persistent if the target does not respond to the initial spearphishing email. They will likely send a follow-up email within 2-3 days of initial contact. - Emails purporting to be from official sources but sent using unofficial email services. **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA ## CAMPAIGNS AND THEMES Kimsuky cyber actors craft their spearphishing campaigns around themes characterizing the target, message content, and the malicious mechanism, or lure, through which a compromise is initiated. The main themes to beware of are impersonations and targeting of journalists, academic scholars, and think tank researchers to: - solicit responses to foreign policy-related inquiries, - conduct a survey, - request an interview, - review a document, - request a resume, or - offer payment for authoring a research paper. Kimsuky actors tailor their themes to their target’s interests and will update their content to reflect current events discussed among the community of North Korea watchers. The following are examples of real Kimsuky spearphishing attempts that illustrate variations of the common themes. In some instances, the cyber actor poses as a journalist and targets a think tank researcher, while at other times, the DPRK actor may take on the persona of an academic scholar to target other scholars—virtually every combination of these themes and lures has been previously observed. ### 1. Impersonation of journalists Kimsuky actors often spoof real journalists and broadcast writers to craft a credible front and make inquiries to prominent individuals working North Korea matters. Usually, the questions will revolve around current events and whether U.S. experts believe North Korea will re-join talks with the U.S., whether they believe North Korea will resume testing its missiles, and how they see China responding. In many instances, Kimsuky actors do not attach malware to their initial email. Instead, they first send an introductory email to inquire about interview opportunities. **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 1:** **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Title: Greetings, My name is , and I am a writer for .** I am writing to you today because I am currently preparing for a program related to North Korean issues. Professor of , whom I contacted earlier, recommended you as an expert on this issue. I would be grateful if you could spare some time to answer a few questions. Thank you for considering my request. I look forward to hearing from you soon. Best regards, **Follow-on email: If the targets agree to the interview, the actors will then follow up with a second** email containing malicious content. Title: RE: RE: Dear , As promised, I am sending you a questionnaire. It would be greatly appreciated if you could answer each question in 4-5 sentences. Thank you for your cooperation. Best regards, @ attached file: [] questionnaire.docx Additionally, we have seen Kimsuky actors spoof legitimate journalists to specifically target think tank employees. Kimsuky actors commonly pose questions in their spearphishing emails about current events, such as issues regarding Russia’s invasion of Ukraine; U.S.-DPRK relations; DPRK nuclear and security topics; policymaker stances on the Asian region; and thoughts on current China-North Korea and Russia-North Korea relations. ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 2:** **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Greetings, I hope you've been well! This is with .** North Korea Fires Powerful Missile on 4 Oct using Old Playbook in a New Worlds. The last time Pyongyang launched a weapon over Japan was in 2017, when Donald J. Trump was president and Kim Jong-un seemed intent on escalating conflict with Washington. I have some questions regarding this: 1) Would Pyongyang conduct its next nuclear test soon after China’s Communist Party Congress in mid-October? 2) May a quieter approach to North Korean aggression be warranted? 3) Would Japan increase the defense budget and a more proactive defense policy? I would be very grateful if you could send me your answers within 5 days. Have a good weekend. Sincerely, ### 2. Impersonation of academic scholars Kimsuky actors impersonate South Korean academic scholars to send spearphishing emails to researchers at think tanks. In these emails, the targets are asked to participate in a survey, such as on North Korean nuclear issues and denuclearization on the Korean Peninsula or requesting an email interview. ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 3:** **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Title: Request for survey Hello, I am from . I am reaching out to ask if you would be willing to participate in a survey on North Korea’s nuclear development titled, “A survey on the perception on experts on the advancement of North Korean nuclear weapons and the denuclearization of the Korean Peninsula”. Our goal is to find ways to resolve North Korean nuclear issues and achieve denuclearization on the Korean Peninsula. Rest assured that all answers will be kept confidential and used solely for research purpose. As a token of appreciation, we would like to offer 300,000 won to those who participate in the survey. If you’re interested in participating, please reply to this message, and we will send you the survey questionnaire. Looking forward to hearing from you soon. Best regards, **Follow-on email: Once targets respond to inquiries, Kimsuky actors send them a survey** questionnaire and a document form for payment, which contains malicious content. Title: RE: RE: Request for survey Thank you for your response. We will send you a document form for payment, which includes a personal information usage agreement. If possible, please fill out your affiliation, name, ID number, bank account, and signature, and attach copies of your bankbook and ID card. Best regards, P.S. The attached document is password-protected, and I will send you the password in a ‘password.txt file’ @ attached file: PersonalInformationUsageAgreement ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 4:** Below is an example of Kimsuky actors pursuing responses to questions on sector targets by posing as a university professor and research student. Once an initial response is received, actors will request an email interview with a list of questions and request that targets access documents via a malicious link to a cloud-hosted service. **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA To: Subject: Re: Request for an interview Dear , Sorry for my late response because of the Profs busy time and thanks so much for replying me your kind answers. I did confer with about it and modified a bit. Please find the link below and let me know if you have the different opinions. https: PWD: Best, To: Cc: Dear , Thanks so much for your fast feedback. I did confer with again and complete it as your request. Please find the updated below. https: PWD: We're planning to upload it on our website within a week after final review. Please feel free to contact with me if you have any questions. Best, ### 3. Impersonation of think tank researchers Kimsuky actors impersonate researchers from legitimate South Korean think tanks to send spearphishing emails to political and North Korean experts. They initiate communication by sending genuine emails to establish rapport and seek opinions on various topics, such as “North Korea’s foreign policy and our response.” ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 5:** **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Title: [Request for opinion] I’m ** Greetings, I am , deputy director of the .** I am reaching out to you to discuss an article I am currently working on. The topic, “North Korea’s foreign policy and South Korea’s response” is somewhat distant from my expertise, so I would greatly appreciate hearing the opinions of experts like you. I would kindly request your comments on my writing, as I believe you are the most appropriate person to provide valuable insights on the subject. Your earlier article caught my attention, and I found myself nodding in agreement with each sentence. That is why I feel confident in asking for your opinion. I am eagerly awaiting your reply and appreciate your willingness to assist me. Thank you for your time and consideration. **Follow-on email: After receiving replies from their targets, the Kimsuky actors exchange multiple** emails, which may include attachments containing malicious links or files and instructions on how to open the attached files. Even after stealing the account information of their victims and infecting their devices with malware, they sometimes continue to send “thank you” emails to their targets. Title: RE: RE: [Request for opinion] I’m ** Thank you for agreeing to provide your opinion. Please find the attached files. We greatly appreciate your input. To ensure security in the face of increasing hacking activity, we have set a password () for the attached file. We look forward to hearing your valuable feedback. ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 6:** Below is an example of Kimsuky actors spoofing a think tank employee and utilizing a spoofed think tank domain in order to target another think tank employee. Once the target responds with input, the Kimsuky actor sends a follow-on email with a malicious attachment. **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Dear , Hope you are doing well. On behalf of , it is my pleasure to invite you to write a 1,200-word piece on the recent NK's provocation. North Korea’s latest missile launches, including the launch of an intermediate-range ballistic missile (IRBM) over Japan on October 4 and two short-range ballistic missiles (SRBMs) on October 6, provide a stark reminder of the numerous missile programs it is pursuing. Subject is as follows: 1) Would Pyongyang conduct its next nuclear test soon after China’s Communist Party Congress in mid-October? 2) May a quieter approach to North Korean aggression be warranted? 3) Would Japan increase the defense budget and a more proactive defense policy? You can send me this email by Oct 21. You can make your own title for your article. We can provide you with a small honorarium of around USD 480.00. I would really appreciate it if you can contribute. Best, Senior Fellow, Director, **Follow-on email:** The Kimsuky actor then sent a second communication with malicious content. Dear , Sorry for my late response. As promised, I’m writing to send our result of the review. Please find the attached and let me know if any problems. PW: Best, Senior Fellow, Director, ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA ### 4. Impersonation of government officials, law enforcement, web administrators Below is an example of how Kimsuky actors approach their targets by impersonating individuals responsible for North Korean policies in government agencies, such as the South Korean National Assembly or the presidential office. These impersonated individuals may have already had their accounts compromised through a previous attack. Kimsuky actors may mention specific information about the target’s position or schedule, which they obtained from the target’s email exchanges or address book. **Sample email communication 7:** **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Title: Office of /Seminar “Proposal for the Unification Policies of the Yoon Government” Hello, this is from the office of . Let me express our gratitude for your attendance and participation at the seminar we hosted yesterday. Your presence and insights contributed greatly to the success of the event. If it’s not too much trouble, could you kindly provide us with a brief summary of the remarks you made during the seminar? We would like to keep it as an internal reference material. Additionally, we would greatly appreciate it if you could fill out the attached form and send it back to us. This will serve as an evidence document for the speaking fee payment procedure. Password: Thank you again for your participation and we hope to see you at future events. Have a great weekend. Kimsuky actors may also impersonate investigative agencies or law enforcement officials to deceive a target into believing that their email account has been involved in an illegal incident. They use the authority of investigative agencies to approach the target, implying that their account may have been stolen and that they could be involved in a criminal or national security-related incident. ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 8:** **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Title: of . I am of . I’m writing to inform you that someone has published content on YouTube using your email account that violates the National Security Law. Link: https:// HYPERLINK "https://%3cyoutube/"< HYPERLINK "https://%3cyoutube/"YouTube video link>. The video was posted on by We also suspect that the same user has posted content that slanders North Korean defectors. We need your cooperation to identify the real publisher of these posts. 1. Provide us with your computer media access control address (MAC address) and Ethernet hardware address, as they are needed to track any illegal access to your email account. 2. If you cannot locate these addresses in your computer system, please run the program below and send us the resulting document: 3) Please respond to this email within 24 hours and delete it immediately after sending your reply. Thanks you for your cooperation Additionally, Kimsuky actors impersonate operators or administrators of popular web portals and claim that a victim’s account has been locked following suspicious activity or fraudulent use. Victims are advised to protect their personal information and unlock their account by clicking a link attached to the email and changing their password. The link leads to a phishing site that mimics a legitimate web portal login page where victims are directed to input personal information, including their usernames and passwords, for harvesting by DPRK cyber actors. ----- **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA **Sample email communication 9:** **TLP:CLEAR** FBI | DOS | NSA| NIS | NPA | MOFA Title: Your Password for Account Has Been Compromised We regret to inform you that we have detected an attempt to log into your account () from an unauthorized application. The incident occurred on at