Full Report
We discovered malicious, targeted advanced persistent threat (APT) activity on a partner's system. Here, we dive into the BABYSHARK malware strain.
Analysis Summary
# Threat Actor: BABYSHARK (Associated with Kimsuky)
## Attribution & Identity
* **Actor Identification:** A DPRK (North Korean) state-sponsored threat actor.
* **Aliases:** Heavily associated with activity groups such as **Kimsuky** (Velvet Chollima / Thallium).
* **Known Associations:** The BABYSHARK malware family is a signature tool for North Korean cyber espionage efforts.
## Activity Summary
In February 2022, Huntress identified targeted APT activity involving a customized variant of the BABYSHARK malware. The operation utilized phishing to gain initial access, followed by the establishment of persistence via scheduled tasks. The actor demonstrated a high degree of customization, tailoring the malware to the specific victim environment to bypass security controls and maintain a long-term presence.
## Tactics, Techniques & Procedures
* **Initial Access:** Phishing (implied via the delivery of initial malicious scripts).
* **Persistence:** Scheduled Tasks (masquerading as legitimate software updates).
* **Masquerading:** Using legitimate filenames and service names like `GoogleUpdater` to blend in ([T1036](https://attack.mitre.org/techniques/T1036/)).
* **Execution:** Use of `wscript.exe` to run malicious VBScript files ([T1059.005](https://attack.mitre.org/techniques/T1059/005/)).
* **Fileless Techniques:** Downloading and executing encrypted scripts directly from cloud services.
* **Data Obfuscation:** Use of custom delimiters—specifically `johnbegin` and `johnend`—to wrap and identify encoded/encrypted data within HTML source code or filenames.
## Targeting
* **Sectors:** National security, Nuclear energy, Think Tanks, and Research organizations.
* **Geography:** Primarily targeted at U.S.-based organizations and South Korean interests.
* **Victims:** Specifically noted as Nuclear Think Tanks and national security organizations.
## Tools & Infrastructure
* **Malware Families:** BABYSHARK (VBScript-based malware).
* **Living-off-the-Land Binaries (LoLBins):** `wscript.exe`, `curl`.
* **Malicious Scripts:** `qwert.vbs`.
* **Infrastructure:**
* **Cloud Hosting:** Exploitation of legitimate Google Drive links to host encrypted second-stage payloads.
* **C2 Delimiters:** Use of specific markers (`johnbegin`/`johnend`) to parse C2 instructions hidden in web page source code.
## Implications
This actor represents a sophisticated, state-aligned threat focused on long-term espionage and information theft. The use of BABYSHARK demonstrates a shift toward "living-off-the-cloud" techniques, where legitimate services (like Google Drive) are used to bypass traditional perimeter defenses. The high level of customization suggests the actor performs significant pre-compromise reconnaissance on their targets.
## Mitigations
* **Monitor Scheduled Tasks:** Audit and monitor for new or unusual scheduled tasks, especially those invoking `wscript.exe` or `cscript.exe`.
* **Script Blocklisting/Restricting:** Restrict the execution of VBScript and other scripting languages unless explicitly required for business operations.
* **Network Filtering:** Monitor and potentially restrict traffic to public cloud storage providers (e.g., Google Drive) from sensitive administrative accounts or servers if not required.
* **Endpoint Detection:** Deploy EDR solutions capable of detecting "masquerading" where non-standard scripts are executed by legitimate Windows binaries.