TODDLESHARK Malware Linked to Kimsuky APT
Recently, security vulnerabilities in ConnectWise ScreenConnect have been exploited by North Korean threat actors to introduce a new malware known as TODDLERSHARK. TODDLERSHARK shares similarities with known Kimsuky malware, including BabyShark and ReconShark.
According to security researchers the threat actors gained entry to the victim's workstation by taking advantage of the exposed setup wizard in the ScreenConnect application. Subsequently, they utilized their gained "hands-on keyboard" access to execute mshta.exe with a URL to the Visual Basic (VB) based malware using cmd.exe.
The specific ConnectWise flaws exploited are CVE-2024-1708 and CVE-2024-1709, which were revealed last month. These vulnerabilities have since been heavily exploited by various threat actors to distribute cryptocurrency miners, ransomware, remote access trojans, and stealer malware.
TODDLERSHARK Expands Kimsuky Toolkit
Kimsuky, also identified as APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet (previously Thallium), KTA082, Nickel Kimball, and Velvet Chollima, has consistently expanded its malware toolkit, with GoBear and Troll Stealer being the latest additions.
BabyShark, initially detected in late 2018, is launched through an HTML Application (HTA) file. Once activated, the VB script malware extracts system information to a command-and-control (C2) server, maintains persistence on the system, and awaits further instructions from the operator.
In May 2023, a variant of BabyShark called ReconShark was observed targeting specific individuals through spear-phishing emails. TODDLERSHARK is considered the latest iteration of the same malware, exhibiting code and behavioral similarities.
Apart from utilizing a scheduled task for persistence, TODDLERSHARK is designed to capture and transmit sensitive information about compromised hosts, making it an effective reconnaissance tool. The researchers note that TODDLERSHARK displays elements of polymorphic behavior, such as changing identity strings in code, altering code positions through generated junk code, and using uniquely generated C2 URLs, potentially making detection challenging in certain environments.
