No little amount of digital ink has been spilled to expose the operations of Black Banshee (a.k.a. Kimsuky), a long-running North Korea-based advanced persistent threat active since at least 2012. Throughout 2019 and 2020, Black Banshee has ramped up its targeting, both in terms of the number of attacks and its victims across the government, defence, education and media sectors. All the while, Black Banshee’s tools and tradecraft have evolved and diversified across different operations. Numerous reports have highlighted specific parts of Black Banshee’s activity – be it the BabyShark campaign, or Black Banshee’s new AppleSeed (a.k.a. AutoUpdate) malware.

But how do Black Banshee’s tools, infrastructure, targeting and strategic objectives intersect? How do they connect Black Banshee’s campaigns in a tight-knight web of activity? And what function do Black Banshee’s multiple, contemporary, interconnected campaigns perform, in the wider landscape of North Korea-based cyber threats?

This presentation aims to offer a more comprehensive and higher-level understanding of Black Banshee’s TTPs and mission by answering the questions above – and to highlight how Black Banshee’s campaigns work in complementary ways to achieve strategic objectives in line with the national interests of North Korea. Attendees will also come away with a summary of what we know of Black Banshee’s recent and latest malware (such as the AppleSeed backdoor and the PowerShell victim fingerprinting tool FlowerPower), as well as of the threat actor’s approach to refactoring its tools and introducing new ones. And, they will gain directly actionable intelligence about Black Banshee’s present modus operandi in setting up command-and-control infrastructure, and about how to identify Black Banshee C2 domains and phishing pages – so they can start hunting as soon as the talk is over.