Loading malware…
ReconShark is a Windows reconnaissance malware component associated with the North Korean espionage actor Kimsuky, also tracked as TA427, APT43, Emerald Sleet, and THALLIUM. It is assessed as an evolved variant or reconnaissance-focused successor of the BabyShark malware family and has been used in targeted intelligence-collection operations against think tanks, research universities, government entities, media organizations, NGOs, North Korea-focused analysts, and other individuals of strategic interest in the United States, Europe, and Asia.
ReconShark is primarily delivered through highly tailored spearphishing campaigns. Observed delivery chains include phishing emails, links to cloud-hosted lure documents, password-protected malicious Office documents, and macro-enabled Microsoft Office files. In some campaigns, operators built rapport with targets over time before sending weaponized documents. The malware has also been observed in an intrusion chain following exploitation of ConnectWise ScreenConnect vulnerabilities CVE-2024-1708 and CVE-2024-1709, where a VBScript-based payload with strong code and behavioral overlap to BabyShark was deployed.
Its core function is host reconnaissance in support of follow-on intrusion decisions. ReconShark gathers information such as running processes, hardware and battery details, user and host characteristics, network configuration, routing and ARP data, installed software, services, recent files, and deployed security products. Variants have used Windows Management Instrumentation and command execution to enumerate the environment, including checks for endpoint protection and other defensive tooling. Some observed samples altered Microsoft Office macro warning settings to reduce user prompts and facilitate macro execution.
ReconShark exfiltrates collected data over HTTP POST and, in some cases, encodes harvested information before transmission. Certain variants avoid writing reconnaissance output to disk prior to exfiltration, while others stage collected data locally and remove artifacts after transmission. The malware has also demonstrated persistence mechanisms, including scheduled-task execution of VBScript stored in an Alternate Data Stream, with periodic polling for additional code.
A notable characteristic of ReconShark is conditional second-stage deployment. Based on the victim environment and detected security controls, it can retrieve and execute additional payloads including VBS, HTA, batch, DLL, malicious Office template, and modified shortcut-based components. Observed tradecraft also includes obfuscation, randomized script elements, changing payload URLs, and simple string encryption to hinder static analysis and signature-based detection. Overall, ReconShark functions as a selective reconnaissance and staging platform that enables Kimsuky to profile victims and tailor subsequent espionage activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In May of this year, we wrote about Kimsuky evolving reconnaissance capabilities in a new global campaign, which was an interesting campaign making use of a new malware component we call ReconShark.
KTA082 (Kimsuky) is known to target individuals using documents containing malicious macros as part of spear phishing campaigns for its RECONSHARK malware.
Tools BabyShark, KONNI, FastFire, FireViewer, FastSpy, ReconShark, KimJongRAT, Kimsuky
21 distinct techniques documented for this family, organized by ATT&CK tactic.
"The threat actors conduct extensive spearphishing operations, using typosquatting or domains thematically aligned with their target."
KTA082 (Kimsuky) is known to target individuals using documents containing malicious macros as part of spear phishing campaigns for its RECONSHARK malware.
Ongoing campaigns use a new malware component we call ReconShark, which is actively delivered to specifically targeted individuals through spear-phishing emails, OneDrive links leading to document downloads... In the malicious emails, Kimsuky entices the target to open a link to download a password-protected document. Most recently, they made use of Microsoft OneDrive to host the malicious document for download.
Similar to previous BabyShark variants, ReconShark relies on Windows Management Instrumentation (WMI) to query process and battery information.
In addition to exfiltrating information, ReconShark deploys further payloads in a multi-stage manner that are implemented as scripts (VBS, HTA, and Windows Batch)...
ReconShark deploys further payloads in a multi-stage manner that are implemented as scripts (VBS, HTA, and Windows Batch)...
The lure documents Kimsuky distributes contain Microsoft Office macros that activate on document close. | ReconShark deploys further payloads in a multi-stage manner that are implemented as scripts (VBS, HTA, and Windows Batch)...
ReconShark functions as a reconnaissance tool... ReconShark checks for the presence of a broad set of processes associated with detection mechanisms, such as ntrtscan.exe, mbam.exe, NortonSecurity.exe, and avpui.exe.
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ReconShark is a Kimsuky reconnaissance malware component delivered via malicious Office macros. It profiles infected systems by collecting running process information, battery details, and endpoint detection products, exfiltrates that data via HTTP POST, and conditionally deploys additional payloads including VBS, HTA, batch scripts, Office templates, and DLLs. It also modifies LNK files and replaces Normal.dotm to achieve further payload execution and persistence-like compromise of Microsoft Word.
Custom malware previously distributed by Kimsuky as part of reconnaissance campaigns to enable subsequent attacks.
ReconShark is reconnaissance malware used by Kimsuky and delivered via password-protected weaponized Office documents. It exfiltrates information useful for follow-on precision attacks, including deployed detection mechanisms and hardware information.
Referenced as a malware payload that TA427 may deploy in rare cases after establishing trust via extended email conversations, potentially to compromise a corporate device when a victim checks personal email on it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.