Researchers have discovered Kimsuky, a North Korean state-sponsored threat group also known as APT43, utilizing a new reconnaissance tool dubbed “ReconShark” during their latest campaign. This campaign has been targeting government organizations, research centers, think tanks, and universities in the United States, Asia, and Europe. ReconShark is noted to have expanded reconnaissance capabilities, including “unique execution instructions and server communication methods,” and is delivered through spear-phishing emails to specifically targeted individuals. The emails involve malicious OneDrive links that lead victims into downloading password-protected malicious documents that have filenames relevant to the targeted user’s subject matter. ReconShark is suspected to be the evolution of the malware “BabyShark” that the group utilized in its campaigns in 2018. ReconShark has the ability to exfiltrate valuable machine information, such as deployed detection mechanisms, running processes, battery information, and deployed endpoint threat detection measures. This ability is critical as researchers suspect that ReconShark is “part of a Kimsuky-orchestrated reconnaissance operation that enables subsequent precision attacks, possibly involving malware specifically tailored to evade defenses and exploit platform weaknesses.” CTIX analysts will continue to monitor North Korean threat groups’ activity and detail emerging malware as they are observed. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.