Kimsuky

October 23, 2026

• Kimsuky multilingual LNK lures, with hunting material. Nextron tracked nine related malicious LNK files submitted September–October 2026 (detection ratios around 10–30 of 60+ engines) running base64 batch scripts decoded by a renamed certutil.exe, staging in C:\Users\Public, nircmd disguised as ntoskrnl.exe, and scheduled tasks firing every nine minutes. Nextron IOCs · Oct 23 · demonstrated · via phishing email · Threat Activity

October 14, 2026

• Kimsuky is reply-baiting Ukrainian diplomacy and security experts. Genians documents fake conference invitations with genuine event details and no malicious payload in the first message — the attachment only arrives after the target replies — plus fake PDFs and Zoom installers. Likely collection targets include North Korean troop losses and the handling of captured soldiers; most observed attempts failed. Japanese-language documents on the same infrastructure suggest planned Japanese targeting (The Record, Dark Reading). · Oct 14 · attempted · via phishing email · Threat Activity

October 13, 2026

• Kimsuky has been observed delivering Funhouse ransomware through a malicious Hangul (HWP) document disguised as a résumé (@blackorbird). · Oct 13 · observed · via phishing email · Threat Intelligence

October 12, 2026

• North Korea-linked Kimsuky has expanded Operation GitPower into Ukraine. Genians Security Center observed reply-driven conference and collaboration lures targeting experts in diplomacy, security, and international policy. The chain uses malicious LNK files, PowerShell, and GitHub/GitLab for delivery, C2, and exfiltration; repositories matched earlier GitPower infrastructure. Most observed attempts were unsuccessful. The broader campaign also uses the opencode AI agent and a local LLM to produce decoy material. · Oct 12 · attempted · via phishing email · Threat Activity

Sep 7 – September 11, 2026 · 2 reports

• Kimsuky's latest LNK-in-spoofed-installer chain checks for 42 security tool processes (idaq64, x64dbg, ProcessHacker, Fiddler) and VMware/QEMU/KVM/Google Compute Engine fingerprints before PowerShell decrypts the next stage, and defeats the JavaScript bot check on its InfinityFree-hosted C2 by downloading and adapting the validation script (analysis) — the group was in earlier coverage. · Sep 11 · observed · Threat Intelligence
• Kimsuky's Operation GitPower is now mass-producing decoys with an AI coding agent: Genians analysed 13 malicious LNK files collected 11–19 August 2026 whose decoy PDF metadata names the open-source agent OpenCode as producer. Lures shifted from diplomacy and academia to finance and corporate operations (fund disbursement, insurance premiums, Visa payments); the LNKs launch PowerShell with encrypted loaders buried in over-long arguments padded with leading spaces, pull decoys and follow-on commands from GitHub Raw using hardcoded PATs, and now add Pastebin as a second-stage channel plus anti-analysis routines that check for virtualization and analysis tooling, inspect sandbox usernames and wipe command history. All 13 share the same decoder constant and array variable name — cheap hunting pivots. · Sep 7 · observed · via phishing email · Threat Intelligence

August 25, 2026

• Kimsuky LNK campaign against South Korean and Japanese targets. Nextron found multiple samples overlapping ENKI WhiteHat's reporting: phishing mail delivering OneDrive-hosted ZIPs containing oversized LNK files with embedded script content and URL-based payload retrieval (Valhalla rule). · Aug 25 · observed · via phishing email · Threat Activity

August 22, 2026

• Kimsuky is installing a malicious Chrome extension that auto-exfiltrates victims' Gmail to C2 in spear-phishing against South Korean and Japanese targets, alongside abuse of legitimate remote-control tooling. Korean-language comments and debug strings throughout the extension's JavaScript suggest most of it was written with generative AI (ENKI). · Aug 22 · observed · via phishing email · Threat Activity

August 11, 2026

• North Korea's Kimsuky is running LLMs offline on its own servers to industrialize operations. Genians documents AI-generated decoy documents, local/private LLM deployments, RAG over stolen files, and .NET/C# AI libraries being collected to build AI into malware — moving beyond public chatbots (The Hacker News, The Register). · Aug 11 · observed · AI & Model Security

July 26, 2026

• Kimsuky is running a phishing campaign impersonating diplomatic staff and deploying PebbleDash and PrxClient, per AhnLab via lazarusholic. · Jul 26 · observed · via phishing email · Threat Activity

July 23, 2026

• Kimsuky compromises South Korean groupware vendors with a new Gomir variant. ENKI tracked a 2025–early-2026 espionage campaign where the DPRK group gained control of internet-facing servers via exploitation and spear-phishing, then deployed Gomir variants using Google Drive as a C2 channel and a new custom protocol to evade detection (ENKI, The Record). · Jul 23 · observed · via phishing email · Threat Activity

July 1, 2026

• Kimsuky's KimJongRAT checks whether Windows Defender is running and branches its execution path accordingly. blackorbird (X) · Jul 1 · disclosed · Threat Activity