Kimsuky JSE Loader Opening NHIS Decoy URLs via wscript/cscript

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects execution activity associated with the Kimsuky NUKESPED loader, specifically identified by the script interpreter spawning processes or making network requests related to specific decoy URLs (NHIS health portal) or opening decoy PDF files from the user's Downloads directory.