Kimsuky VBScript XMLHTTP GET to acnms.dmdoc.dynv6.net bootservice.php C2

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•5

Detects network activity initiated by wscript.exe or DNS queries related to the Kimsuky downloader infrastructure, specifically identifying callbacks to the domain 'acnms.dmdoc.dynv6.net' and associated malicious bootservice.php script retrieval behavior.