News and Analysis

North Korean hacking group Kimsuky is developing custom tools to exploit Remote Desktop Protocol (RDP) and increase control over compromised systems. The group has created a proprietary version of the open-source RDP Wrapper, which allows remote desktop features even on non-supported Windows versions. The efforts are part of a larger campaign involving spear-phishing and malware, where shortcut files pretending to be legitimate documents trigger further payloads from external servers.