VBScript-driven MSXML2 HTTP GET to Kimsuky bootservice.php C2 endpoint

Ethan Andrews@eandrews

•updated Jul 2, 2026•1•0•2

Detects wscript.exe executing VBScript that uses the MSXML2.XMLHTTP component to perform an HTTP GET request to a specific Kimsuky C2 URL (acnms.dmdoc.dynv6.net). This activity is associated with a multi-stage infection chain where a VBScript file retrieves and executes a subsequent stage from the specified remote endpoint.