Kimsuky threat actors are conducting spear-phishing campaigns against targets in South Korea and Japan using OneDrive-hosted LNK files. Once executed, the malware establishes persistence through scheduled tasks and retrieves PowerShell scripts to steal system information, emails, and keystrokes. The attackers also abuse legitimate remote control tools such as Chrome Remote Desktop and AnyDesk to maintain access while blending with normal administrative activity.
The investigation uncovered a multi-stage infection chain involving malicious LNK files, obfuscated VBScript, and PowerShell scripts. Researchers analyzed specialized components including a malicious Chrome extension designed to collect Gmail data and scripts used to install AnyDesk. Korean-language and debug strings found in AI-generated code also suggest that the operators may be using generative AI during development.
Users should exercise caution when opening LNK files or links received from unknown sources, especially because Windows can hide file extensions. Organizations should regularly audit installed software for unauthorized Chrome Remote Desktop or AnyDesk deployments. Monitoring browser extensions for excessive or unexpected permissions is also strongly recommended.
If Kimsuky activity is detected, security teams should review scheduled tasks for suspicious entries launching wscript.exe or powershell.exe . Unexpected AnyDesk processes and files located in %appdata% directories should also be investigated. Browser extensions and remote desktop configurations should be reviewed to identify and remove unauthorized access mechanisms.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary has gained an initial foothold on the Windows workstation via a spear-phishing attachment. To establish Command and Control (C2) and begin the exfiltration of system information, the attacker executes a PowerShell one-liner. This script is designed to mimic the Kimsuky group’s known behavior: contacting a specific PHP endpoint on a compromised server to receive further instructions. The goal is to blend in with standard web traffic while hitting the precise C2 endpoint identified by threat intelligence.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
