Trend Analysis on Kimsuky Group’s Attacks Using AppleSeed

The report describes Kimsuky (North Korea–supported) spearphishing campaigns that deploy backdoors and infostealers—notably AppleSeed and a Golang variant AlphaSeed—via JavaScript droppers, LNK shortcuts, and droppers that use Regsvr32 with required execution arguments to evade sandboxes. It documents AlphaSeed’s ChromeDP-based C2 (cookie-based login), Meterpreter and VNC/HVNC remote access tools, shifts from RDP to Chrome Remote Desktop, persistence locations and filename decoys under %APPDATA%/%PROGRAMDATA%, detection names, sample MD5s, and C2 URLs, concluding with mitigation advice and file/behavior detections.