Kimsuky JSE Loader Drops NUKESPED DLL with Non-Standard Extension in ProgramData

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.