Executive Summary
Stormshield has uncovered the 'Trigram' campaign, an industrialized North Korean cyber operation attributed to Kimsuky (APT43) and the UNK_DeadDrop cluster. The campaign targets developers in the AI, blockchain, and logistics sectors across Europe and the US by impersonating approximately 50 high-profile brands. Using sophisticated social engineering, the actors lure victims to fake recruitment or conference websites that employ the 'ClickFix' technique to trick users into executing malicious terminal commands.
The technical infrastructure is highly organized, utilizing a dedicated management platform (rms-platform) that automates target scraping from GitHub, manages massive email delivery through multiple providers, and tracks victim progression in real-time. The attack chain culminates in the deployment of the OverLord infostealer, which targets browser credentials, cryptocurrency wallets, and sensitive files. This campaign demonstrates an evolution toward automated, marketing-style campaign management and the abuse of legitimate cloud services for resilience.
The threat is significant for organizations in the cryptocurrency and emerging technology sectors. The industrialized nature of the platform allows the adversary to rapidly swap decoys and C2 infrastructure, making traditional domain-based blocking less effective. Immediate focus should be placed on detecting the specific 'ClickFix' PowerShell/Bash commands and monitoring for unauthorized Node.js deployments on developer workstations.