Kimsuky adds Chrome Remote Desktop to a toolkit it never retires

Order matters more than the tool. Every remote-access option ASEC lists arrives after AppleSeed is already resident ^[10], and AppleSeed on its own runs operator commands, installs further malware, logs keystrokes, captures screenshots and steals files ^[11]. The remote desktop session is not the way in. It is how an operator sits down at a machine that has already been taken, on a channel that does not depend on the backdoor's own HTTP command path ^[12].

The migration reading needs the caveat ASEC supplies itself. Customized VNC and RDP Wrapper logs are still being detected ^[3], and RDP Patcher was dropped in the same intrusions that produced the remote desktop installs ^[10], a utility that exists only because a normal Windows environment allows one RDP session per PC ^[14]. Count what ASEC attributes to this group and there are four distinct routes to an interactive session: Meterpreter, patched VNC, RDP modification, and now a sanctioned remote desktop service ^[15]. That is accumulation. A control set tuned to the first three loses coverage without any of them being abandoned.

What remains stable is everything upstream of the access tool. AppleSeed will not execute unless it is launched with 123qweASDZXC passed to /I ^[9], which is a hard behavioural condition rather than a hash. Two versions are in circulation, both talking to their C&C over HTTP ^[12]. The credential stealer writes to a fixed location under C:\ProgramData\Adobe, and the current build reaches past Chrome into Microsoft Edge and Naver Whale ^[13]. ASEC's own note on that stealer is the useful one: it was first identified last year and the same code keeps being reused rather than replaced ^[13].

That is the shape of the whole kit. AppleSeed has been detected since around 2019 ^[11], about six years into a campaign history that starts in 2013 ^[16], and the group was already hitting a Korean energy corporation in 2014 before broadening beyond South Korea in 2017 ^[5]. Delivery is still document-shaped: HWP, MS Office and CHM attachments in spear phishing mail ^[6], with WSF or JS scripts wearing document extensions and opening a decoy file so the victim sees what they expected ^[7]. In the cases ASEC describes, the initial delivery step was not even identified; the group was caught at the script stage by log telemetry ^[8].

Anyone who has been scoring Kimsuky detections by implant name has been grading the wrong column. The parts that change are the ones vendors write signatures for.