"We Are About to Land": How CloudDragon Turns a Nightmare Into Reality
summary
Research separates Kimsuky into two clusters and attributes a persistent North Korean APT named CloudDragon that operates since 2017 using specific toolchains: Jumper/DreamBug backdoor with plugin architecture, script-based BabyShark loaders, and an Android variant that harvests and zips SMS. CloudDragon conducts a confirmed supply chain compromise of a Korean hardware wallet via an NW.js installer, uses a proxy mirror phishing technique to relay real sites, and deploys audio recording plugins to capture meetings.
AI-written summary · about
chapters (10)
- 0:00Introduction to Cloud Dragon
- 2:39Group profile and malware
- 7:24Infrastructure and malware
- 11:57Techniques and analysis
- 15:22Supply chain attack study
- 20:13Phishing and target scope
- 24:34Proxy mirror technique
- 26:15Expanding to mobile platforms
- 29:05Physical security impacts
- 32:07Wrap up and takeaways
related talks
50mThe Anatomy of Cloud Attacks
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
26mThe Secret Life of Sandworms
39mReal-World Detection Evasion Techniques in the Cloud
42mDriven Response to UNC5174
46mAttacks, Lies and the Underground World
16mNation-State Threats in the Open-Source Software Supply Chain