project

Chrome Remote Desktop

Google Chrome remote-access capability used in prior Kimsuky cases to control infected systems.

Current clusters

security1 distinct publisher

Kimsuky adds Chrome Remote Desktop to a toolkit it never retires

ASEC says the North Korean group now installs Chrome Remote Desktop after AppleSeed lands, while its older VNC and RDP Wrapper activity keeps turning up in logs.

Publishers:asec.ahnlab.com

Reality

Evidence62
Adoption44
Hype gap+8
Incentives55

security1 distinct publisher

Kimsuky keeps picking RDP, which puts detection on configuration instead of files

AhnLab's latest writeup on the North Korean group shows the bespoke code doing account hiding and port forwarding while a shipped Windows feature carries the actual session.

Publishers:asec.ahnlab.com

Reality

Evidence62
Adoption45