Kimsuky NUKESPED Sandbox Evasion: zlrenu8.exe or Hidden PowerShell certutil Decode from wscript

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.