Kimsuky Spearphishing: JSE Loader Execution from Downloads via Korean Health Lure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects malicious activity associated with the Kimsuky NUKESPED campaign, specifically the execution of .jse droppers from the Downloads directory using Windows Script Host (wscript.exe/cscript.exe), execution of known malicious files by SHA256 hash, and the presence or creation of the associated zlrenu8.exe payload.