Kimsuky NUKESPED JSE Loader: PowerShell certutil decode from ProgramData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects a suspicious sequence of events where a file with an architecture-specific name (often associated with botnet payloads like JDY/KV-botnet) is created, executed, and deleted within a 60-second window. This behavior is indicative of transient malicious payloads executing and self-removing to evade detection.