Executive Summary
In January 2026, a sophisticated cyber espionage campaign attributed to the North Korean threat actor Kimsuky (Velvet Chollima) was identified. The attack utilizes a multi-stage infection chain beginning with a social engineering lure disguised as a Korean health document. This initial dropper extracts a JSE loader that employs advanced obfuscation, XML DOM manipulation, and PowerShell execution to deploy the final NUKESPED backdoor payload.
Technically, the campaign is notable for its use of legitimate infrastructure, specifically Fastly CDN, to mask Command and Control (C2) communications and its ability to evade modern detection. The secondary executable, zlrenu8.exe, demonstrated extremely low detection rates across antivirus engines, highlighting the group's continued evolution in tradecraft and anti-analysis techniques, including long sleep delays and sandbox detection.
The impact is primarily focused on South Korean government entities and infrastructure. The NUKESPED payload provides the attackers with extensive capabilities including remote access, keystroke logging, screen capture, and sensitive file exfiltration, posing a critical risk to affected organizations.