Back Gbhackers

Kimsuky Uses Malicious LNK Files to Drop Python Backdoor

Gbhackers •Mayura Kathir • April 3, 2026

Kimsuky is using multi-stage malicious LNK files to deploy a Python-based backdoor, adding new intermediate scripts while keeping the final payload logic largely unchanged. The campaign abuses Windows Task Scheduler, Dropbox, and bundled Python runtimes to evade detection and maintain persistence on infected systems. The ZIP contained a Python script (can.py), a standalone Python interpreter, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Group Uses Malicious LNK Files to Deploy Python-Based Backdoor The Kimsuky group, a North Korean threat actor, has been identified using malicious LNK files to deliver a Python-based backdoor to victim systems. This attack method involves multiple stages, making it difficult for security tools to detect the final payload. AhnLab's recent findings indicate a structural change in the intermediate execution phase of the attack, although the overall flow remains consistent with previous campaigns. The specific impact scope and number of affected systems have not been disclosed. The campaign is ongoing, with security experts urging vigilance against this evolving threat. The use of LNK files as a delivery mechanism highlights a persistent trend in targeted cyberattacks. Organizations should be aware of this method to enhance their defensive measures. 4 sources 60

Extracted Entities

Kimsuky Uses Malicious LNK Files to Drop Python Backdoor

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (2)