Kimsuky JSE Loader Spawning Hidden PowerShell to Decode ProgramData Payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects instances where wscript.exe or cscript.exe spawn a hidden PowerShell process that includes '-decode' arguments targeting files within the C:\ProgramData directory. This pattern is characteristic of the Kimsuky threat group, specifically the NUKESPED JSE loader, which uses Windows Script Host to execute staged, base64-encoded payloads.