Kimsuky JSE Loader: PowerShell Hidden Window certutil -decode Staging NUKESPED

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of PowerShell via WScript or CScript (WshShell.Run) with hidden window flags, involving the use of 'certutil' to decode a staged payload located in a ProgramData directory. This pattern is characteristic of Kimsuky loader activity.