우리 북한 해킹 단체 김수키(Kimsuky)에서 만든 피싱 사이트-hogmasil(.)lol(1)(2024.3.22)

오늘은 우리 북한 해킹 단체 김수키(Kimsuky)에서 만들어 놓은 피싱 사이트 인 hogmasil(.)lol(2024.3.22)에 대해 글을 적어 보겠습니다.
2017년 Cisco Talos 연구원이 처음 발견했으며, 2014년부터 탐지되지 않은 채 고도의 타깃 공격으로 하는 북한의 해킹 단체 Thallium, APT37과 관련된 해킹 단체이며 Kimsuky(김수키)에서 만든 것이며 해당 부분은 안드로이드 APK 하고 연관이 있는데 해당 APK 분석은 나중에 하는 걸로 시간이 나면 글자 적어 보는 것을 하겠습니다. 해당 사이트는 보면 카카오,구글,피싱 메일 전송(이것 추측)이 되는 것이 보입니다. 예를 들어서 다음과 같습니다.
구글 드라이브
gattach(.)html이라는 이름의 iframe은 Google 로그인 오류 메시지를 모방하여 사용자에게 일시적인 통신 오류를 알리고 로그인 세부정보를 다시 입력하라는 메시지를 표시합니다.
서버와의 통신이 임시 중단되었습니다.
Google에서 서버와의 통신과정에 임시 오류가 발생하였으며 그 때문에 Gmail 서비스가 잠시 중지되었습니다. 계속하려면 다시 로그인해주시기 바랍니다.
해당 gattach(.)html를 보면 아산정책연구원에 계시는 분인 외교부 아프리카중동국장 XXX 분의 이메일 계정이 포함된 것을 확인할 수가 있었습니다.

hogmasil(.)lol gattach(.)html 서버와 통신이 임시 중단 되었습니다.

웹 소스

</td>
<!-- <td align="right" style="font-family: Roboto-Light,Helvetica,Arial,sans-serif;">???
</td> -->
<td align="right" width="35">
<img width="28" height="28" style="width: 28px; height: 28px; border-radius: 50%;;"
src="data(:)image/gif;base(6)4(,)iV(B)ORw0KGgoAAAANSUhEUgAAAPgAAADFCAYAAAB5NT94AA
AAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAmmSURBVHhe7d3P
URtJGIbxYRMwF5/BV1+MA3AJRwAZGCKADEwGJgO4+iQyAB99goPvIgEXZKDlne22G5Y/Epru+frr51fFap
GrKCHNM9/MaDSsze90AFz6J9wCcIjAAccIHHCMwAHHCBxwjMABxwgccIzAAccIHHCMwAHHCBxwjMABxwgcc
IzAAccIHHCMwAHHCBxwjMABxwgccIzAAccIHHCMwAHHCB(x)wjMABxwgccIzAAccIHHCMwAHHRvvjg1dXV9
3t7W34DvBpfX2929raCt+VVzRwBX18fNx/6Rff3NwM/wL4pEGmZX1vb687PDzs/78oBV7CdDqdv3nzZr6zsz
O/vLwM9wL+nZ+fzyeTSb/86/9LKh(L)4yclJ/8spcqBVsQPdlpJ9E/3i4qLb3d3tb8fcFwEsUAefP3/u7r
Zii/SQPXDtZ2vfQ18Auu7o6Kg7Ozvr989zy/o22enpaX9L3MBfClwHnBV5blkD1y9A3MD/qYvqA9f+xvb2
dvgOQKT97xKb6(F)n3wdfW1nSUPnwHIFWiD05VBRwjcMAxAgccI3DAMQIHHDMbuE4G0KfOAOssn+9hNnCd
v67A9T769fV1uBewQ2ejaTnVR0Gtnu9hNvB4IoBu9cU0hyWa2vF6BhpACt2iKk500RlxWksqdJ3fXvxD80
Cgqa1l(U)cuklsVVwuZEl0CbP/HKGFprljiHF3goTm19WZ7aqepOVdWTHPd5mOYoQTHrIJqGjJa5ofa3me
CP0FozHnRjmiM3HfvRrqGWNQVu9WDaU6r+sEmc5oo+XsgRGIKGiJYt3Q45tVNM8BfEaa4DH1rL6sAH(s)K
o4tfVV49S+RxM8l8w//p54QbuDg4P5zc1NuBdY3Gw2669+urGxUeTqpyX6qHqCp7Q5pbWtvpjmWJarqZ0K
oWeR+cc/6du3b0xzLKT01E6V6MPNBE/FtzTimli3wENup3YqhJ5F5h+/EE1zPY6vX7+G(e)9C6Mad2qkQf
Lid4StNcF5nXW2pxTY12NTG1UyH0LDL/+KVpiusxMc3bY2Vqp0r04X6Cp/QZ83SaxzPi4FtzUzvRVOASX2
SdJKP/14sPn7QCV8w6E00rdb3WrZ3t2FzgUfz7UHrRtRAwzX2J(U)1uvbWtTO9Vs4BJf/Lj5xjSvX3w9Nb
V1spNW5E0L++JZZP7xg9KBFx2A0YEYTo6pU20HUUv00fQET6XTnI+h1iW+bnrNdBC1+amdCqFnkfnHZ6Np
rlNdd3Z2mObG1fzWZ4k+mOCPSA+6Mc1tYmovhsCf(o)LdTtPDoYE28qIQ+d47xKeaPHz/2r0kMHY8j8BfE
i0qIpjkfQx0PU3t5BL6AdJoreJ3fzjQvi6n9OlVfk20Mmua5r9WFvxSznm/R8+0pbK7JZlDcTNcUZ5rnxd
ReHRN8Bek01yY8C+AwPE/tFBPcuHSa(a)1Odgz6r03Oo51KBM7VXxwQfSCtTJ5e4otQBTT1/Wnl6xwSviI
JW5Npf1H4j03wxOn4Rj2doBanQW4i7FCZ4BkzzxShmPU8KupWpnWKCVyqd5tqf5GOo96VTW7dM7XyY4JnF
ad7SvuVzWp/aKSa4A5rm(W)qh1q69WpzlTexxM8IJanV5M7ccxwZ3R/rg22eM018LuGVN7fEzwkcSpFkP3
drVPpvbLmOCOxWkuWvh1qqsHTG1bmOAGKG5NO0Vf8zRnai+HCd4ITbv0ohK1TXOmtl0EbkR6UQ(l)NQYWi
cKxTzDqOoBWUvvS4YQeBGxOneTzaroAs0spHKyI9Xr23r5WTtwOFHhC4QQpFYaebvZamuWLWJrgek1ZGeo
ywiYNsxikgTUrdavNdB+LGEqe2Vj56LIS9Gg6yoZ+U6TQf62OocWoLU7seTPCK((xGmuSaoJqn303Jja+T
DBcU+c5oqsxEUlmNr1Y4JXKn4MVYae5kztMpjgeJKCVuRDT3Omti9McAfiNNfba5q4MdBlMLXLY4JjIXGa
61Zfy15UgqntmCZ4Lpl/vGknJyf93xgvTX/bfGNjYz6ZTOaz2Sz(+)zj97XP9DXQ9zul0Gu4tR8uHnqdWl
eiDCZ6BNnH1vrU2d0t7eFGJp6Z5nNrarB9rat/F3e3v7/fPFzIJoWeR+cebFCf35eVluGc8cZprSmtaS5z
aul//PjY9X1pOWpzkJfog8AFZijtS0F++fOkf18HB(w)Z/bGLwFrUZO4BWxGHdK+9jaL7cwtR/TYuQEXgn
rcdeitcgJvALEPayWIidw44g7j1YiJ3DDiDuvFiIncKOIuwzvkRO4QcRdlufICdwY4h6H18gJ3BDiHpfHy
AncCOK2wVvkBG4AcdviKXICHxlx2+(Q)lcgIfEXHb5iFyAh8Jcdeh9sgJfATEXZeaIyfwwoi7TrVGTuAFE
XfdaoycwAshbh9qi5zACyBuX2qKnMAzI26faomcwDMibt9qiJzAMyHuNliPnMAzIO62WI6cwAdG3G2yGjm
BD4i422YxcgIfCHFDrE(V)O4AMgbqQsRU7gKyJuPMZK5AS+AuLGcyxETuCvRNxYxNiRE/grEDeWMWbkBL4
k4sZrjBU5gS+BuLGKMSIn8AURN4ZQOnICXwBxY0glIyfwFxA3cigVOYE/g7iRU4nICfwJxI0SckdO4I8gb
pSUM3ICf4(C)4MYZckRN4grgxphyRE3hA3LBg6MgJ/A5xw5IhI28+cOKGRUNF3nTgxA3Lhoi82cCJGzVYN
fImAydu1GSVyJsLnLhRo9dG3lTgxI2avSbyZgInbniwbORNBE7c8GSZyN0HTtzwaNHIXQdO3PDspchvbm(
7)qD/zDhw/z8/Pz8N1fxI0WPBf5dDqdTyaT8F0+/9w9gGy2t7e7s7Oz8N1/Tk9Pu8PDw+7i4qLb2toK9wL
+7O3tdXdxd/v7+/1yn1IXRZb/EHoWmtCa1NocESY3WvRwks9ms(/)5(7)3ea2pv/0pWeyu7v755bJjVZpg
muSKzdt2aqB4+Pj8K/5ZA/89va2e//+fff79+/u58+fxI2mabP96uqqH3Tr6+vh3nyy7oOLfonv3793b9+
+7Y6OjvrggdZcX1/3W7El45bsgcunT5+6X79+9b/U5uZ(m)vxbTL0ns8EzLtw6maXl/9+5dv+yXjFuyb6I
/pDWZ9j20Jvvx40e4F/BpMpn0u6U6/qTASyseOIByimyiAxgHgQOOETjgGIEDjhE44BiBA44ROOAYgQOOE
TjgGIEDjhE44BiBA44ROOAYgQOOETjgGIE(D)jhE44BiBA44ROOAYgQOOETjgGIEDjhE44BiBA44ROOAYg
QOOETjgGIEDjhE44BiBA44ROOAYgQOOETjgVtf9Cy4AtsBJ+CrtAAAAAElFTkSuQmCC">
</td>
</tr>
</tbody>
</table>
</td>
<td></td>
</tr>
<tr>
<td style="background:url('../../accountalerts/email/hodor/4-pixel-w(.)png')
center left repeat-y;" width="6"></td>
<td style="height: 4px; background-color: #ea4335;"></td>
<td style="background:url('(.)./../account(a)lerts/email/hodor/4-pixel-e(.)png')
center left repeat-y;" width="6"></td>
</tr>
<tr><td style="background:url('.(.)/../accountalerts/email/hodor/4-pixel-w(.)png')
center left repeat-y;" width="6"></td>
<td><div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;padding-left:
20px; padding-right: 20px;border-bottom: thin solid #f0f0f0; color:
rgba(0,0,0,0.87); font-size: 20px;padding-bottom: 30px;padding-top:
32px;text-align: center; word-break: break-word;">
<div class="v2sp">
<div style="text-align: center; padding-bottom: 13px">
<img height="79px" src="../../ac(c)ountalerts/email/Red_circle_x2_35x39(.)png">
</div>
	서버와의 통신이 임시 중단되었습니다.<br>
	<!-- <a style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color
    rgba(0,0,0,0.87); font-size: 16px; line-height: 1.8;">????????@gmail(.)com</a> -->
																</div>
															</div>
<div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 13px;
color: rgba(0,0,0,0.87); line-height: 1.6;padding-left: 20px; padding-right:
20px;padding-bottom: 32px; padding-top: 24px;">
	<div class="v2sp">Google에서  서버와의 통신과정에 임시 오류가 발생하였으며
    그로 인하여 Gmail 서비스가 잠시 중지 되었습니다. 계속하려면 다시 로그인해주시기 바랍니다.
	<div style="padding-top: 24px; text-align: center;">
	<a href="Phishing_URL" target="_self" style="display:inline-block;
    text-decoration: none;">
	<table align="center" border="0" cellspacing="0" cellpadding="0"
    style="background-color: #4184F3; border-radius: 2px; min-width: 90px;">
	<tbody>
	<tr style="height: 6px;"></tr>
<tr><td style="padding-left: 8px; padding-right: 8px; text-align: center;">
	<a href="Phishing_URL" target="_self" style="font-family:
    Roboto-Regular,Helvetica,Arial,sans-serif; color: #ffffff; font-weight: 400;
    line-height: 20px; text-decoration: none;font-size: 13px;">로그인</a>
	</td>
	</tr>
	<tr style="height: 6px;"></tr>
</tbody>
	</table>

웹소스 설명

해당 HTML 코드 조각은 피싱 이메일의 일부분
피싱 이라는것은 다 알것이니까? 피싱에 대한 설명 하지 않겠습니다.
해당 이메일은 Gmail 사용자에게 서버와의 통신이 임시 중단되었습니다 라는 메시지를 표시하고 로그인 버튼을 클릭하도록 유도

hogmasil(.)lol gattach(.)html 서버와 통신이 임시 중단 되었습니다. 웹소스

피싱 이메일의 특징:
1. 의심스러운 발신자:발신자 이메일 주소가 이상하거나 알 수 없는 도메인에서 발송
2.긴급한 메시지:서버와의 통신이 임시 중단되었습니다와 같은 긴급하고 경고적인 메시지로 사용자를 당황하게 만듬
3.클릭 유도 링크:로그인 버튼이 포함되어 있으며 해당 버튼을 클릭하면 가짜 로그인 페이지로 이동하게 돼 있음
4. 이미지 사용:Gmail의 로고와 같은 이미지를 사용하여 신뢰성을 높이려 함
5. 링크 주소: 링크 주소가 공식 사이트와 일치하지 않음 여기서도 Phishing_URL로 연결
결론
메일 서비스에서 자격 증명을 수집하려는 시도 아무튼 해당 gattach(.)html 에서는 아산정책연구원에 계시는 분인 외교부 아프리카중동국장 노린 것을 추측됩니다.
해당 사이트 시리즈를 몇 번을 나누어서 글을 적어 보아야겠습니다.