Kimsuky NUKESPED Randomized Executable Spawned from Script Host in ProgramData/Temp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of short (6-10 characters), randomized alphanumeric executables located in typically writeable directories like ProgramData or Temp. The detection triggers when these files are spawned by common scripting engines (wscript.exe, cscript.exe, or powershell.exe), which is a characteristic behavioral pattern for the Kimsuky NUKESPED malware's secondary stage where a JSE dropper executes a renamed payload.