Executive Summary
A recent analysis identifies a sophisticated multi-stage campaign attributed to Kimsuky (APT43) using compiled HTML (CHM) files as initial lures. The attack targets Korean-speaking individuals, specifically those interested in North Korean food security and human rights, through decoy content. The infection chain is characterized by its reliance on built-in Windows utilities like certutil, wscript, and PowerShell to minimize its on-disk footprint.
The operation is highly selective, using initial VBScript stages to perform deep system reconnaissance, including process enumeration and directory listing. This data is exfiltrated to a C2 infrastructure hosted on dynamic DNS (dynv6) before the actor decides whether to deliver the final payload. This gating mechanism effectively complicates automated sandbox analysis, as the C2 often returns empty responses if the target does not meet specific, though currently unconfirmed, profiling criteria.
This activity highlights Kimsuky's evolving tradecraft in defense evasion and persistence. By splitting the execution chain, the actor protects their high-value malware from exposure and allows for dynamic adjustment of their tactics without needing to redistribute the original lure.