Kimsuky JSE Loader ADODB.Stream Payload Drop to ProgramData (.a9oc/.lpXD)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the Kimsuky threat group using a JSE-based loader to write decoded binary payloads to the C:\ProgramData directory. The files are written using randomized filenames with specific non-standard extensions (.a9oc, .lpXD, .lpxQ, .lpXO) initiated by wscript.exe or cscript.exe, a technique observed in their January 2026 campaign.