Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy

Unit 42 analyzed two undocumented malware samples attributed to the North Korean APT Sparkling Pisces (Kimsuky): a C++ keylogger named KLogEXE that captures keystrokes, running applications and mouse clicks and exfiltrates data via HTTP, and a DLL backdoor variant called FPSpy that collects system data, downloads encrypted modules, executes commands, and persists under user directories; the report maps shared infrastructure, provides file and domain indicators, and outlines protections and mitigations.