Loading malware…
BabyShark is a Windows-focused malware family associated with North Korea-linked espionage activity, particularly operations attributed to Kimsuky and related clusters such as TA406. It has been described as a VBScript-based sequential implant that functions as a persistent downloader or loader, executing additional scripts or payloads after initial compromise. Campaigns distributing BabyShark have used spam and spearphishing lures, including COVID-19-themed messages and politically themed decoys aimed at policy, national security, diplomatic, academic, media, and government targets, including U.S. national security think tanks and South Korean entities.
Observed BabyShark tradecraft includes use of mshta for payload retrieval and execution, scheduled tasks for persistence, and Registry modification to weaken Microsoft Office macro protections and support continued execution. Variants have collected host reconnaissance data through native commands such as tasklist, whoami, and ipconfig, and have gathered broader system, user, network, process, service, software, and security-product information. BabyShark has also been observed decoding downloaded content prior to execution, encoding stolen data with certutil before exfiltration, and deleting temporary artifacts after secondary payload execution or data theft. Some variants include PowerShell-based remote administration functionality capable of deploying a PowerShell- or C#-based keylogger.
Reporting in 2024 linked a BabyShark-like variant to exploitation of ConnectWise ScreenConnect vulnerabilities CVE-2024-1708 and CVE-2024-1709 for initial access, followed by delivery of heavily obfuscated VBScript stages, persistence via a scheduled task, and selective follow-on tasking. Across reporting, BabyShark is consistently characterized as an espionage-oriented implant used to profile victims, maintain footholds, retrieve additional payloads, and exfiltrate collected information.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2024-1708 (CVSS:8.4) is a path traversal vulnerability that can allow an attacker to execute code remotely on the ScreenConnect server. Together, CVE-2024-1709 and CVE-2024-1708 can allow a threat actor to perform remote code execution post authentication. | The Kroll CTI team observed a campaign using a new malware that appears to be very similar to BABYSHARK... Kroll assessed it is likely that this is a variant of the BABYSHARK malware due to code and behavioral similarities.
Two critical vulnerabilities, tracked as CVE-2024-1708 and CVE-2024-1709, were recently addressed in ConnectWise ScreenConnect and have been exploited by many threat actors due to its ease of exploitability. CVE-2024-1709 (CVSS:10) can allow for authentication bypass due to insufficient path filtering. | The Kroll CTI team observed a campaign using a new malware that appears to be very similar to BABYSHARK... Kroll assessed it is likely that this is a variant of the BABYSHARK malware due to code and behavioral similarities.
"We have not observed an in-the-wild case yet, but we did find a PHP sample exploiting CVE-2018-8174 (Windows VBScript Engine Remote Code Execution Vulnerability) on the BabyShark C2 server, and this suggests that the threat actor may be leveraging this vulnerability to make a target load BabyShark’s first stage HTA via a watering hole attack or a malicious URL in a spearphishing email."
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The spam campaigns were used to distribute BabyShark implants, often associated with the cyber operations of North Korea.
TA406 has had access to BabyShark since at least early 2019; however, based on our visibility, this actor was not the original user of BabyShark.
Adversary Malware Target • TroiBomb • RoastMe • JamBog (AppleSeed) • BabyShark • DongMulRAT (WildCommand)
Adversary Malware Target • TroiBomb • RoastMe • JamBog (AppleSeed) • BabyShark • DongMulRAT (WildCommand)
Adversary Malware Target • TroiBomb • RoastMe • JamBog (AppleSeed) • BabyShark • DongMulRAT (WildCommand)
These same techniques have also been associated with threat groups like APT32 and are leveraged by malware families such as AgentTesla and BabyShark.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
The activity started with exploitation of a recently addressed authentication bypass in the remote desktop software ScreenConnect... The threat actor gained access to the victim workstation by exploiting the exposed setup wizard of the ScreenConnect application.
This report details a specific phishing campaign used to distribute the Agent Tesla RAT. The lure in the emails is centered around updates to COVID-specific PPE.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
TA427 was still using BabyShark, QuasarRAT, PCRat, browser extensions (Chrome, Edge and Firefox), and numerous PowerShell scripts (keylogging, exfiltration of emails and more).
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
BabyShark... VBScript-based, sequential malware: persistent downloader / loader, executing further scripts/payloads
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
In addition to downloading additional files, access specific registries and change values as shown below.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The initial payload downloaded by MSHTA utility was a heavily obfuscated VB script, containing randomly generated functions and variable names along with large amounts of hexadecimal encoded code and additional junk code.
Several malicious subdomains discovered seem to spoof email or cloud service providers, but a few of them appear to target specific organizations.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
The main purpose of these activities seems to be credentials gathering, thanks to spearphishing emails and phishing websites.
The domain name « login-main.bigwnet.com » is a C2 server for a malicious document intitled « Speaking notes-ExMon Deterrence Summit-24-Mar-rev-26-Mar19.doc ».
AppleSeed URL structure... FlowerPower... sends it to the C2 via HTTP POST.
127 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Implant delivered via COVID-themed spam targeting South Korean entities.
A malware/campaign family discussed as historically linked to KimJongRAT and attributed in the report to Kimsuky.
Malware payload referenced as being delivered after QR-code (“quishing”) spear-phishing; used to establish access after credential harvesting and support follow-on activity (persistence/lateral movement/exfiltration) in the described Kimsuky campaign.
Named as one of the major malware tools used by Kimsuky.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.