Executive Summary
AhnLab SEcurity intelligence Center (ASEC) has identified a campaign by the Kimsuky threat group distributing 'Funhouse' ransomware, a variant of the previously known 'Endpoint' ransomware. The attack begins with a phishing email containing a malicious Hangul (HWP) document disguised as a resume. Unlike recent campaigns that used LNK files, this approach relies on OLE objects and embedded hyperlinks to trigger a multi-stage infection chain.
The technical workflow involves executing a VbsEdit script that triggers a sequence of Batch, VBS, and PowerShell scripts. This sequence ultimately installs a Python-based backdoor and Quasar RAT, which is then used to deploy the Funhouse ransomware. The ransomware itself shares significant code commonalities with Endpoint ransomware, including encryption watermarks and ransom note naming conventions, though it features updated contact information and C2 infrastructure.
This evolution demonstrates Kimsuky's persistence in refining their ransomware tradecraft and shifting initial access vectors to evade detection. The targeting of corporate entities via resume-themed decoys poses a significant risk to HR and recruitment-heavy sectors, emphasizing the need for robust document sanitization and user awareness regarding embedded links.