Kimsuky NUKESPED XML DOM Base64 Decode Chain: WScript Spawning certutil-decode PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a suspicious PowerShell execution chain where a script host (wscript.exe or cscript.exe) spawns PowerShell to perform a file decoding operation via 'certutil' using a path in 'ProgramData'. This pattern is associated with the Kimsuky threat group's NUKESPED JSE loader, which uses path traversal or obfuscated filenames to stage malicious secondary payloads.