North Korean threat actors are escalating their cyber operations against Web3 and cryptocurrency businesses using sophisticated malware written in the Nim programming language, demonstrating their evolving attack capabilities.
## NimDoor: A New Malware Arsenal
Security researchers from SentinelOne have identified a malware suite called NimDoor that employs advanced techniques rarely seen in macOS attacks. The malware uses process injection and encrypted WebSocket communications (wss protocol) for stealth operations. A unique persistence mechanism leverages signal handlers to maintain presence even when the system reboots or the malware is terminated.
## Social Engineering Attack Chain
The attacks begin with sophisticated social engineering tactics:
– Threat actors contact targets via messaging platforms like Telegram
– They schedule fake Zoom meetings using Calendly
– Victims receive emails with malicious “Zoom SDK update” scripts
– The script executes AppleScript that downloads additional malicious components
## Technical Attack Mechanics
The infection process involves multiple stages:
1. **Initial Loader**: A C++ component called InjectWithDyldArm64 decrypts and injects malicious code into legitimate processes
2. **Data Harvesting**: The malware steals credentials from popular browsers (Chrome, Firefox, Edge, Brave, Arc) and extracts Telegram data
3. **Persistence**: Nim-based executables monitor for termination attempts and ensure continuous operation
4. **Command & Control**: AppleScript beacons communicate with servers every 30 seconds, sending system information and receiving commands
## Kimsuky’s ClickFix Campaign Evolution
The North Korean group Kimsuky continues refining their “ClickFix” social engineering technique through the BabyShark campaign:
### Recent Attack Variants:
– **Fake Interview Requests**: Impersonating German business newspapers to target South Korean security experts
– **Diplomatic Deception**: Posing as U.S. national security officials with meeting invitations
– **Job Portal Scams**: Creating fake defense research job websites with malicious listings
### Technical Implementation:
– Victims are tricked into copying authentication codes or PowerShell commands
– Malicious scripts establish persistence through scheduled tasks
– Chrome Remote Desktop software enables remote system control
– Multiple command-and-control servers collect victim data
## Infrastructure and Tools
Kimsuky demonstrates operational sophistication by:
– Using GitHub repositories with Personal Access Tokens to host malware
– Deploying open-source tools like Xeno RAT and MoonPeak
– Leveraging cloud services (Dropbox, GitHub) for command infrastructure
– Maintaining infected system logs in private repositories
## Threat Landscape Impact
According to NSFOCUS data, Kimsuky ranks among the most active North Korean threat groups, accounting for 5% of all advanced persistent threat activities in May 2025. Their continuous adaptation of attack techniques and infrastructure demonstrates the persistent nature of state-sponsored cyber operations targeting cryptocurrency and Web3 sectors.
The evolution from traditional programming languages to Nim showcases how threat actors exploit newer technologies’ unique capabilities, such as compile-time function execution, to create more sophisticated and harder-to-detect malware.