security1 distinct publisher
Kimsuky keeps picking RDP, which puts detection on configuration instead of files
AhnLab's latest writeup on the North Korean group shows the bespoke code doing account hiding and port forwarding while a shipped Windows feature carries the actual session.
Publishers:asec.ahnlab.com
Reality
- Evidence62
- Adoption45
- Hype gap+8
- Incentives60