TRANSLATEXT

MITRE ATT&CK: S1201 View on attack.mitre.org

Aliases: TRANSLATEXT

First seen
2023-06-01 00:00:00
Malware type
spyware, trojan
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 15:29:28

Targeted industries: government-and-public-sector

Targeted regions: country_code:kr

Context

TRANSLATEXT is malware that is believed to be used by Kimsuky. TRANSLATEXT masqueraded as a Google Translate extension for Google Chrome, but is actually a collection of four malicious Javascript files that perform defense evasion, information collection and exfiltration.

Detection coverage

  • 346 Sigma rules

Malware & tools used

  • Web Protocols (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • PowerShell (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Modify Registry (attack-pattern)
  • Browser Session Hijacking (attack-pattern)
  • Dead Drop Resolver (attack-pattern)
  • Steal Web Session Cookie (attack-pattern)
  • Screen Capture (attack-pattern)
  • Browser Extensions (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Email Collection (attack-pattern)
  • Bidirectional Communication (attack-pattern)
  • Query Registry (attack-pattern)
  • Traffic Signaling (attack-pattern)

Used by threat actors

Reports & references

  • MITRE ATT&CK — S1201 (report)
  • zscaler.com — Kimsuky Deploys Translatext Target South Korean Academia (report)

External references