North Korean Kimsuky and Lazarus Join Forces to Exploit Zero-Day Vulnerabilities Targeting Critical

Du'aine Davis

Observed in the wild

• Between 2024 and 2025, North Korean APT groups Kimsuky and Lazarus collaborated in attacks targeting military, blockchain, and critical infrastructure sectors globally. A notable case involved a South Korean blockchain firm losing $32 million in cryptocurrency after Lazarus exploited a Windows zero-day (CVE-2024-38193) following Kimsuky’s phishing-based intelligence gathering.
• Kimsuky deployed spear-phishing emails disguised as academic invitations, embedding FPSpy backdoors and keyloggers to map networks and steal credentials. Lazarus leveraged shared intelligence to exploit zero-day vulnerabilities, escalate privileges, and deploy stealth malware (InvisibleFerret, Fudmodule) for cryptocurrency theft. Both groups used shared C2 infrastructure, anti-detection techniques, and domain name polling for evasion.
• Organisations should enable automatic Windows updates, prioritising patches for similar zero-days. Use Microsoft Defender to monitor for behaviours such as HWP files invoking winlogon.exe, unusual access to blockchain wallet directories, and privilege escalation attempts on unpatched hosts. Validate academic or cooperation emails via official channels, enforce strict file handling policies, and strengthen wallet security with hardware-based solutions

North Korean APT duo joins forces: Kimsuky steals intelligence as eyes, Lazarus steals coins to fill money bags! | CN-SEC Chinese websiteSouth Korea Cryptocurrency Exchange Bithumb Says Hacked, $32 Million In Coins Stolen
CVE-2024-38193 - Security Update Guide - Microsoft - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability