Kimsuky JSE Loader: PowerShell Spawned from wscript/cscript with ProgramData Decode

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where wscript.exe or cscript.exe spawn PowerShell with suspicious command-line arguments indicative of the Kimsuky NUKESPED campaign. This involves PowerShell commands using window-hidden styles, decoding flags, or referencing ProgramData/path-traversal patterns often used by Kimsuky to load malicious payloads.