北朝鮮のAPTグループKimsukyが、AI（LLM）を利用して開発した疑いのある新型バックドア「HelloDoor」を用いた攻撃を展開しています

Subject: [Intel] Kimsuky's AI-enhanced Backdoor 'HelloDoor' and Stealthy Infiltration

Dear Security Team,

We are sharing intelligence regarding a new campaign by the Kimsuky APT group.

■ Overview
Kimsuky has deployed a new Rust-based DLL backdoor named 'HelloDoor,' which exhibits characteristics of AI-assisted development (LLM). The attackers are using Cloudflare's 'TryCloudflare' service to mask C2 infrastructure and are leveraging legitimate tools such as VSCode remote tunneling and DWAgent for stealthy access.

■ Scope
- Primarily targeting South Korean government, military, defense, and telecom sectors.

■ Recommended Actions
1. Monitor for the execution of unauthorized Rust-based DLLs on endpoints.
2. Audit and restrict outbound traffic to tunneling services like TryCloudflare if not required for business.
3. Review the usage of remote management tools (e.g., VSCode Remote Tunnels) to ensure they are not being used as persistence mechanisms.

■ Reference
- Kaspersky Deep Analysis Report

Priority: High
Deadline: Immediate review