Larva-24005

Executive Summary

Larva-24005, a North‑Korean threat actor linked to the Kimsuky (Velvet Chollima) group, conducts sophisticated spear‑phishing campaigns that combine social engineering with exploitation of critical CVEs such as BlueKeep and NTLM hash disclosure. The actor targets a wide spectrum of sectors—government, defense, academia, media, finance, healthcare—and employs custom backdoors, keyloggers, and RDPWrap for persistence. Their operations extend beyond South Korea to the U.S., China, Japan and other regions, utilizing messaging platforms (Signal, WhatsApp), OAuth abuse, malicious blogs, and mobile malware to gain initial footholds before escalating privileges and exfiltrating data.

Goals & Targeting

The actor’s strategic objective appears to be broad‑scale intelligence gathering on entities that influence or observe North Korean affairs. By focusing on government agencies, think tanks, academic institutions, retired diplomats, military personnel, and high‑profile journalists across multiple countries, Larva-24005 seeks to harvest policy deliberations, research outputs, diplomatic communications and technical expertise that can inform state policy decisions. Its targeting pattern reflects a nuanced approach: initial compromise through phishing or software exploitation, followed by credential theft and persistent remote control to facilitate ongoing surveillance and exfiltration of sensitive data.

Key Capabilities

• Spear‑phishing via crafted emails impersonating experts
• Delivery via malicious blogs targeting high‑profile individuals
• Use of backdoor RATs such as AppleSeed and Quasar‑based xRAT for persistence and remote control
• Deployment of mobile malware targeting Android devices
• Exploitation of software vulnerabilities (e.g., VPN update flaw, Facebook Messenger) to install malware
• Phishing email campaigns targeting Japanese entities
• Exploitation of NTLM hash disclosure vulnerability CVE‑2025‑24054 via malicious .library-ms files
• Abuse of Microsoft OAuth 2.0 workflows to obtain authorization codes
• Social engineering using Signal and WhatsApp
• Exploitation of RDP vulnerabilities including BlueKeep (CVE‑2019‑0708)
• Deployment of custom malware MySpy and RDPWrap for persistence
• Keylogging to capture user input
• Use of droppers and RDP scanners in multi‑stage attacks
• Targeted reach across South Korea, the U.S., China, Japan, and other countries

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Larva-24005’s operational tempo is rapid and multi‑phased. Campaigns typically begin with mass spear‑phishing campaigns that leverage both email spoofing and malicious content delivery via blogs or OS exploitation, followed by credential harvesting and installation of backdoors for persistence. Victims are primarily individuals in sectors critical to national security—government ministries, defense contractors, research institutions, media outlets, and financial firms—often across multiple countries. The group frequently reuses the same adversary tactics and custom malware components, indicating a well‑researched but evolving toolkit that continues to be refined for broader geographic reach. Notable past operations include the Kimsuky/Babyshark attacks on U.S. think tanks, targeted ransomware campaigns via Quasar RAT, and recent exploitation of VPN update flaws to target corporate networks in Japan and China.

IOC Patterns

• Public email addresses used in spear‑phishing
• Malicious blog URLs delivering payloads
• VPN update exploits targeting login interfaces
• Facebook Messenger malicious attachments
• Phishing emails with malicious attachments (e.g., .zip, .lzx)
• Malicious .library-ms files for NTLM hash disclosure
• Abuse of Microsoft OAuth 2.0 workflows to capture authorization codes
• Use of Signal and WhatsApp for social engineering
• Exploitation of CVE‑2025‑24054 NTLM hash disclosure vulnerability
• Exploitation of CVE‑2019‑0708 BlueKeep

Recommended Actions

• Deploy advanced email filtering and user training focused on spear‑phishing that impersonates experts
• Block malicious blog domains and URLs via web filtering and threat intelligence feeds
• Implement endpoint detection & response capable of detecting AppleSeed, xRAT, and other RAT activity
• Patch VPN software and messaging platforms promptly to mitigate known exploitation vectors
• Apply critical patches for CVE‑2025‑24054, CVE‑2019‑0708, and CVE‑2017‑11882 on all systems
• Enforce multi‑factor authentication for OAuth 2.0 workflows and all remote access services
• Monitor and block suspicious .library-ms files and other malspam artifacts
• Harden Remote Desktop configuration by restricting RDP usage and disabling unnecessary services
• Deploy keylogger detection tools, droplet scanners, and RDPWrap detection methods
• Maintain updated threat intelligence feeds on known malicious domains and IOC patterns

Suggested Tags