Kimsuky Spearphishing LNK Disguised as Korean Financial Document

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•5

Detects the creation or presence of Windows Shortcut (LNK) files that use deceptive double extensions (e.g., .pdf.lnk) and specific filenames related to South Korean financial reporting, a technique associated with the threat actor Kimsuky to entice users into executing malicious code.