Resources
  • Research
  • Intelligence Blogs
Kimsuky's New Golang Stealer 'Troll' and 'GoBear' Backdoor Target South Korea
2024.02.13

Five days ago, a detailed analysis report on a malware suspected to be linked to North Korea, first disclosed by the S2W Threat Intelligence Center (Talon), was extensively covered in an in-depth article on The Hacker News. 🙏


👉 Read The Hacker News article directly: https://bit.ly/3OEv3QY


The content of the analysis report reveals that the APT group believed to be associated with North Korea, named Kimsuky, is speculated to be behind the distribution of the information-stealing malware 'Troll Stealer,' written in the Go language (Golang). This is the first time such speculation has been publicly disclosed.


The basis for this speculation includes the recent active usage of Go-based malware by the Kimsuky group and the presence of code similarities between Troll Stealer and several previously identified malwares associated with the Kimsuky group, such as AppleSeed and AlphaSeed.

For a detailed report on the information-stealing malicious code, InfoStealer, which is favored by attackers, you can also find it through the resources on the S2W website.


👉 Explore more from the S2W report: https://bit.ly/49a5GPp

List