Kimsuky NUKESPED JSE Loader: XML DOM Payload Drop and Hidden PowerShell Decode

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects malicious activity associated with the Kimsuky threat group's NUKESPED JSE loader, including the use of wscript/cscript to execute .jse files, drop encoded payloads via ADODB.Stream, and spawn hidden PowerShell processes for decoding stages (targeting .a9oc files in ProgramData). The rule also detects the creation and execution of the NUKESPED secondary payload zlrenu8.exe.