Executive Summary
AhnLab SEcurity intelligence Center (ASEC) has identified a tactical shift in the Kimsuky threat group's distribution of malicious LNK files. The group has moved from a relatively simple LNK-to-PowerShell-to-BAT execution flow to a more complex, multi-stage process involving VBScript, XML-based task scheduling, and legitimate cloud services like Dropbox for data exfiltration.
The attack typically begins with a malicious LNK file disguised as a legitimate document (e.g., a resume or technical guide). Once executed, it establishes a foothold by creating hidden directories and registering scheduled tasks to execute Python-based malware, including the 'beauty.py' backdoor. This backdoor features a custom binary protocol for remote command execution, file manipulation, and system information gathering.
This campaign highlights Kimsuky's persistence in evolving their tradecraft to evade detection. By leveraging Python interpreters and multiplexing intermediate execution stages, the group complicates behavioral analysis and signature-based detection, posing a significant risk to targeted individuals and organizations.