Executive Summary
Recent threat intelligence indicates that the North Korean cyber-espionage group Kimsuky (also known as APT43 or Emerald Sleet) is leveraging public FreeDNS zones to host malicious infrastructure. Specifically, the group has registered subdomains under 'home[.]kg' to impersonate legitimate development tools and authentication services.
The attack chain primarily involves social engineering and technical impersonation of Visual Studio Code's OAuth redirect mechanisms. By using domains like 'vscode.auth.home[.]kg', the actors aim to intercept authentication tokens from high-value technical targets including developers, DevOps engineers, and researchers. This allows the group to gain unauthorized access to source code repositories and sensitive internal environments.
While the top-level domain is Kyrgyzstani (.kg), this is a result of using the 'afraid.org' FreeDNS service rather than a geographic targeting indicator. Organizations should be aware that these domains are being resolved via infrastructure located in Poland (80.68.237[.]36) and the United States (153.75.247[.]209), highlighting the global nature of their command-and-control (C2) and phishing setup.
Key Details
Threat Name
Kimsuky APT43
Affects
—
Adversary
Kimsuky
MITRE Techniques
—
Malware/Tools
None identified