Threat Trend Report on APT Groups – June 2025 Major APT Group Trends
Purpose and Scope
This report covers nation-led threat groups, presumed to conduct cyber espionage or sabotage supported by certain governments. These groups are referred to as advanced persistent threat (APT) groups for the sake of convenience. Therefore, this report does not contain information on cybercriminal groups aiming to gain financial profits.
We organized analyses related to APT groups disclosed by security companies and institutions including AhnLab during the previous month; however, the content of some APT groups may not have been included.
The names and classification criteria may vary depending on the security company or researcher, and in this report, we used well-known names of AhnLab Threat Intelligence Platform (ATIP)’s threat actors.
Major APT Group Trends by Country
1) North Korea
North Korean APT groups used GitHub PATs to turn private repositories into attack infrastructure. Also, they continue to pose as remote IT workers to join companies and steal information for financial profit. The US government has also prosecuted North Korean IT workers and those who help them.
Jasper Sleet
North Korean threat actors such as Jasper Sleet have been found posing as remote IT workers, creating fake identity documents with AI and using RMM tools to try to infiltrate companies and steal information for financial profit.
| Case 1. | |
| Time | 2018 – October 2024 |
| Attack Target |
· US technology, critical manufacturing, and transportation companies · Global companies hiring for technology-related positions in various industries · Some government agencies (at least two in the US) |
| Initial Breach |
· Used fake resumes and IDs to infiltrate the remote IT hiring process · Created fake portfolios and accounts on LinkedIn, GitHub, and freelance sites · Contacted recruiters or intermediaries on Facebook, Telegram, and other platforms when necessary |
| Vulnerability Used | None |
| Malware and Tools |
· Faceswap and other AI image generation and editing tools · Voice changer software · RMM tools (TinyPilot, Rust Desk, TeamViewer, AnyViewer, Anydesk, etc.) · VPN/Astrill VPN · VPS/Proxy · IP-based KVM devices (PiKVM, TinyPilot) |
| Technique |
· Infiltrates the hiring process using fake identities and profiles · Makes ID and profile photos and changes voices with AI · After being hired, delivers company hardware to an accomplice and uses it for remote access · Hides location and activities with RMM and VPN · Avoids video interviews with false excuses or having an accomplice attend instead |
| Damage |
· Exfiltration of confidential information, such as source code, IP, and trade secrets · Infiltrated at least 64 US companies and obtained more than $860,000 |
| Description |
· North Korean IT workers used Chinese or Russian IP addresses or stolen foreign identities to apply for US and global IT jobs, and used AI to forge identity documents to gain trust. · After being hired, they sent company hardware to North Korea or an accomplice, or connected to an accomplice’s laptop farm to work remotely. · Then, they installed RMM software, used a VPN to hide their location, and had an accomplice handle video or in-person interviews if necessary. |
| Source | Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations[1] |
Kimsuky
The Kimsuky group used Facebook, email, and Telegram to launch a spear phishing campaign against activists in North Korea and defense sectors, spreading AppleSeed malware, and stealing confidential information in a three-step combo attack.
| Case 1. | |
| Period | March – April 2025 |
| Attack Target | South Korea’s defense industry and defense sector |
| Initial Breach |
· Sent friend requests on Facebook Messenger to start a conversation and deliver a malicious file · Sent a malicious compressed file by email · Sent a malicious file via Telegram message |
| Vulnerability Used | None |
| Malware and Tools | AppleSeed |
| Technique |
· Multi-step approach through Facebook, email, and Telegram (three-step combo) · Pretends to support North Korean defectors to gain trust, then sends a malicious file · Evades detection by using the EGG compressed file format · Runs Windows Script Host (JSE), loading DLL with regsvr32, and securing persistence · Hides collected information with RC4 and RSA encryption, and sends it disguised as a PDF · Continuous command and control communication with the C2 server |
| Damage |
· Exfiltration of confidential information from infected systems · Executing commands and resending through the C2 server |
| Description |
· The Kimsuky group uses three channels—Facebook, email, and Telegram—to try to communicate with their targets. They pretend to be volunteers for North Korean defectors and send an EGG archive file that contains a malicious JSE file. · Compared to previous cases, there is a high similarity in the use of JSE and DLL files and in the attack patterns. They also use the Korean EGG compression format and try to avoid detection by prompting users to use a decompression program. |
| Source | Analysis of the Kimsuky group’s three-step combo threat[2] |
The Kimsuky group used a hard-coded GitHub PAT to turn private repositories into attack infrastructure, carrying out a sophisticated spear phishing attack that spread XenoRAT and uploaded victim information.
| Case 2. | |
| Period | March – May 2025 |
| Attack Target | Individuals in South Korea facing financial, legal, or cryptocurrency-related situations |
| Initial Breach |
· Sent spear phishing emails impersonating a Korean law firm · The attached malicious compressed file contains an LNK and PowerShell-based downloader that leads to initial infection |
| Vulnerability Used | None |
| Malware and Tools |
· XenoRAT · onf.txt · ofx.txt · Github PAT(Personal Access Token) · PowerShell script |
| Technique |
· Uses GitHub private repositories and hard-coded PAT for command and control and data leak · Malware distribution using Dropbox · Uses tailored decoy documents (such as debt collection notices, power of attorney documents, etc.) · Maintains persistence through the Task Scheduler and regular log uploads · Uses XenoRAT to control infected systems, perform keylogging, and steal information |
| Damage |
· Stole the victim’s personal and system information · Continuous collection of information, including keylogging and clipboard data |
| Description |
· The Kimsuky group operates multiple private repositories on GitHub dedicated to attacks, and manages decoy documents, Infostealers, logs files in each repository. · Many collected XenoRAT variants had the same build environment (GUID) and encryption method. The reuse of test IPs from previous MoonPeak cases linked to Kimsuky and the same C2 server used for Naver phishing sites also indicates a link to Kimsuky. |
| Source | Analysis of Kimsuky’s latest attacks in South Korea using GitHub as attack infrastructure[3] |
[1] https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/
[2] https://www.genians.co.kr/blog/threat_intelligence/triple-combo
[3] https://www.enki.co.kr/media-center/blog/dissecting-kimsuky-s-attacks-on-south-korea-in-depth-analysis-of-github-based-malicious-infrastructure
※ For more information, please refer to the attachment.
