TRANSLATEXT Malware: A Silent Kimsuky Threat

In cybersecurity, the emergence of new threats is a constant challenge. One such recent threat is the TRANSLATEXT malware, a sophisticated tool employed by the notorious North Korean hacking group Kimsuky. Here’s an in-depth look at TRANSLATEXT, what it aims to achieve, how it affects users, and ways to protect against it.

What is TRANSLATEXT Malware?

TRANSLATEXT is a malicious Google Chrome extension designed to infiltrate and extract sensitive information from targeted devices. First observed in early March 2024, this malware disguises itself as a benign tool, making it difficult for users to detect its true nature. Its extensive capabilities include the ability to harvest email addresses, usernames, passwords, cookies, and browser screenshots.

The campaign employing TRANSLATEXT has primarily targeted South Korean academia, specifically those involved in North Korean political affairs. This aligns with the historical modus operandi of Kimsuky, a North Korean cyber-espionage group active since at least 2012. Known for their focus on gathering intelligence and financial gains, Kimsuky’s activities are often directed against South Korean entities.

What Does TRANSLATEXT Malware Want?

The primary goal of TRANSLATEXT malware is to facilitate intelligence collection. Infiltrating devices allow Kimsuky to conduct surveillance and gather valuable information on academic and government personnel. This stolen data can include sensitive personal information, credentials, and insights into political and military affairs, which are highly interesting to North Korean intelligence operations.

Kimsuky has been linked to a variety of cyber-espionage and financially motivated attacks. They are part of the Reconnaissance General Bureau (RGB), a North Korean military intelligence agency, and are associated with notorious groups like the Lazarus cluster. Their recent activities include exploiting a known vulnerability in Microsoft Office (CVE-2017-11882) to distribute keyloggers and other espionage tools.

What Happens When Users Encounter TRANSLATEXT Malware?

When a device is infected with TRANSLATEXT, the malware operates silently in the background, exfiltrating data to a remote server. The infection typically starts with a ZIP archive containing a Hangul Word Processor document and an executable file, which users might encounter through spear-phishing or social engineering tactics. Once the executable is launched, it retrieves a PowerShell script from an attacker-controlled server. This script gathers information about the compromised system and uploads it to a GitHub repository, where additional malicious code is downloaded.

TRANSLATEXT masquerades as a Google Translate extension and incorporates JavaScript to bypass security measures of services like Google, Kakao, and Naver. It captures browser screenshots, siphons off credentials and cookies, and fetches commands from a Blogger Blogspot URL to execute further malicious actions, such as taking screenshots of newly opened tabs and deleting browser cookies.

How to Protect Devices from TRANSLATEXT Malware

Protecting against TRANSLATEXT and similar malware requires a multi-faceted approach:

1. Be Cautious with Email Attachments and Links: Do not open attachments or click links from unknown or suspicious sources. Spear-phishing is a common method for spreading malware like TRANSLATEXT.
2. Use Strong, Unique Passwords: Employing strong, unique passwords for different accounts can limit the damage if credentials are compromised. Consider using a password manager to keep track of complex passwords.
3. Keep Software Updated: Regularly update your operating system, browser, and other software to patch vulnerabilities that malware could exploit.
4. Install Reputable Security Software: Use comprehensive security software to detect and block malware. Ensure it is regularly updated to recognize the latest threats.
5. Enable Multi-Factor Authentication (MFA): MFA adds another security layer by requiring an additional form of verification, thus making it harder to gain access even if the attackers have your password.
6. Educate and Train: Awareness is key. Educate yourself and others about the tactics used by cyber attackers, such as phishing and social engineering, to reduce the risk of falling victim to these schemes.

By staying informed and vigilant, users can protect themselves from the silent yet significant threat posed by TRANSLATEXT malware and other cyber threats orchestrated by groups like Kimsuky.