Netscout Stolen Pencil Dec 2018

Kimsuky has gathered credentials using Mimikatz and ProcDump.

Kimsuky has used RDP for direct remote point-and-click access.

Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes. Kimsuky has also leveraged Native Windows API functions such as `GetAsyncKeyState()` along with others to capture keystrokes every 50 milliseconds and stores data in a file stored in the temp directory.

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.

Kimsuky has used tools that are capable of obtaining credentials from saved mail.

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.

Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.