Kimsuky certutil decode of Link.dat into Link.ini VBScript payload

Ethan Andrews@eandrews

•updated Jul 2, 2026•0•0•2

Detects the use of certutil.exe to decode a base64-encoded file named Link.dat into an executable VBScript payload named Link.ini, specifically within the %USERPROFILE%\Links directory. This behavior is indicative of Kimsuky infection chains where malicious CHM files or MSHTA scripts trigger secondary payloads.