Loading story…
North Korea-linked Kimsuky has been tied to a series of phishing campaigns that delivered malware through files disguised as PDFs, resumes, questionnaires, and North Korea-related consultation documents. Across the observed intrusions, victims were lured into opening password-protected archives, enabling Office macros, or executing VBS and CHM files, after which the malware launched follow-on payloads through tools such as wscript.exe, mshta.exe, regsvr32.exe, and PowerShell. The implants opened decoy documents to reduce suspicion, established persistence with scheduled tasks, Startup-folder copies, or HKCU\Run entries, and contacted attacker-controlled infrastructure including kro.kr, webcindario, and PHP-based command-and-control endpoints.
The recovered payloads show Kimsuky broadening from simple downloaders into multi-stage surveillance and theft malware. Reported capabilities include host reconnaissance, browser and email data theft, crypto-wallet artifact collection, file upload and download, keylogging, clipboard capture, active-window monitoring, and registry changes that weaken Microsoft Office security settings. Researchers also linked newer operations to a wider infrastructure ecosystem, including SharpExt-related panels and a compromised site used to deliver browser-extension malware, while one later campaign exfiltrated stolen victim data through the GitHub API instead of FTP, indicating continued adaptation in both delivery and collection methods.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
ASEC said its RAPIT system recorded a server response containing additional attacker commands in the North Korea-themed VBS phishing campaign. The response wrote Base64 data to a temporary file, decoded it with certutil into mscornet.vbs, and deleted the temporary file.
A recovered Hangul Word Processor lure titled "The Burden of the Unintended.hwp" was created and later tied to older Kimsuky operations. Walmart Global Tech reported the file's creation date as 2022-02-24.
K7 Labs described Kimsuky, also known as Black Banshee, as a North Korean state-sponsored APT group that has been active since at least 2012.
K7 Labs analyzed a recent Kimsuky infection chain delivered through a ZIP archive containing a VBScript, PowerShell loader, and two encoded log files. The decoded payloads performed browser and wallet data theft, reconnaissance, persistence, file transfer, keylogging, clipboard monitoring, and active window logging.
ASEC identified an email campaign distributing a password-protected Word document named "[붙임] 약력 양식.doc" that impersonated a professor. After macro execution, the malware downloaded additional scripts and used the GitHub API instead of FTP to upload browser-stolen victim information to a repository that already contained suspected victim data.
Walmart Global Tech expanded prior reporting on Kimsuky's SharpExt operations by identifying additional domains, panel structures, and a compromised website linked to the campaigns. The analysis also connected this infrastructure to older malicious-document operations and victim targeting in the United States, Europe, and South Korea.
ASEC identified a phishing campaign distributing a password-protected archive containing a malicious CHM file disguised as an interview questionnaire. The CHM decoded a VBS payload, added persistence through the HKCU Run key, and led to PowerShell-based keylogging, clipboard theft, and exfiltration.
ASEC reported continuous distribution of malicious Word documents themed around North Korea-related topics. In one observed flow, the attacker first sent a benign consultation request and only provided a malicious download link after the recipient replied.
Walmart Global Tech reported that the compromised website nuclearpolicy101.org was updated earlier in the year to deliver browser extension code tied to the same Kimsuky command-and-control endpoint. The site had already been used by the group for over a year.
ASEC identified a phishing campaign distributing a malicious VBS script named "2022 이력서 양식.vbs" inside a compressed attachment. The malware collected host information, exfiltrated it to webcindario URLs, opened a decoy HWP file, and established persistence via a scheduled task and Startup folder.
ASEC reported discovering APT attacks targeting certain Korean companies using a VBS file disguised as a PDF. The activity was assessed with moderate confidence as likely conducted by Kimsuky based on tradecraft and infrastructure overlaps.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
labs.k7computing.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourcemedium.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean state-backed threat group **Kimsuky** has been linked to an ongoing spear-phishing campaign targeting organizations and individuals in the United States, Europe, and Asia, including think tanks, research universities, government entities, and staff at Korea Risk Group. Researchers said the operation uses tailored phishing emails and **OneDrive-hosted password-protected documents** containing malicious Microsoft Office macros to gain initial access. The campaign delivers a new reconnaissance malware component dubbed **ReconShark**, assessed as an evolved variant of BabyShark. ReconShark gathers host data including running processes, battery status, and installed security products, then exfiltrates the information via HTTP `POST` requests without first writing it to disk. Based on the victim environment, the malware can also deploy follow-on payloads such as VBS, HTA, batch scripts, DLLs, malicious Office templates, and modified LNK files; supporting infrastructure was identified on NameCheap-hosted shared servers tied to domains including `yonsei[.]lol`, `rfa[.]ink`, `mitmail[.]tech`, and `newshare[.]online`.
Jun 29, 2026
Researchers linked a North Korean **Kimsuky** intrusion cluster to spearphishing campaigns that deliver ZIP archives containing malicious `.lnk` files, which launch obfuscated PowerShell, open decoy PDF documents, and create persistence through scheduled tasks. The activity, tracked by Genians as **Operation GitPower**, also used public **GitHub** and **GitLab** repositories as command-and-control channels and malware staging infrastructure, including encrypted `.NET` **AsyncRAT** payloads disguised as image files. Fortinet separately reported DPRK-linked campaigns using the same combination of LNK-based infection chains and GitHub-backed C2, reinforcing the pattern across related operations. Investigators said the operators appear to be expanding beyond conventional malware delivery and are actively experimenting with **AI-enabled tradecraft**. Artifacts showed local LLM environments built with tools including **Ollama**, **GPT4All**, and **Msty**, along with RAG-style document handling, AI agent development libraries, and **Whisper** speech-to-text components, suggesting a research-and-integration phase focused on malware development, document analysis, and attack automation rather than training original models. Attribution was supported by overlaps with prior Kimsuky techniques, Korean-language artifacts, North Korean lexical patterns, Arirang manufacturer strings, and use of **Astrill VPN**.
Aug 17, 2026
North Korea-linked **Kimsuky** continued spear-phishing operations built around the **AppleSeed** malware family, delivering payloads through JavaScript droppers, Excel macros, and malicious **OneNote** files disguised as business documents, surveys, purchase orders, and request forms. Researchers tied the activity to targeted campaigns against South Korean organizations as well as scientific and engineering researchers, with lures impersonating trusted institutions and decoy documents used to trigger hidden scripts. In multiple cases, the malware was launched through `regsvr32.exe`, fetched follow-on components with `mshta.exe`, and shifted persistence and installation patterns from `%PROGRAMDATA%` toward `%APPDATA%`, while adding anti-analysis checks to evade defenders. The group also introduced **AlphaSeed**, a Golang-based evolution of AppleSeed that uses embedded **Naver Mail** cookies and the Chrome DevTools Protocol for command-and-control instead of older mailbox authentication methods. AlphaSeed was reported to persist via the Windows Run key as **`MS_SecSvc`**, collect keystrokes and screenshots, encrypt stolen data with **RC4** and **RSA**, and exfiltrate data through Naver Mail. Across the broader intrusion chain, Kimsuky was observed using post-compromise tools including **Meterpreter**, **TightVNC**, and TinyNuke-derived **HVNC**, while increasingly favoring **Chrome Remote Desktop** over RDP; researchers also documented multi-platform artifacts, mobile AppleSeed-related components, server-side scripts, and operational links connecting these campaigns to earlier Kimsuky activity.
Aug 15, 2026