"ScreenConnect Flaws Used to Deploy ToddlerShark Malware"
North Korean threat actors have exploited vulnerabilities in ConnectWise ScreenConnect to deploy a new malware called TODDLERSHARK, which overlaps with known Kimsuky malware such as BabyShark and ReconShark. The malware is designed to capture and exfiltrate sensitive information about compromised hosts and exhibits polymorphic behavior to evade detection. South Korea's National Intelligence Service has accused North Korea of compromising the servers of two domestic semiconductor manufacturers and pilfering valuable data, with the intrusions taking place in December 2023 and February 2024.
