From Endpoint to Funhouse: Changes in Ransomware Families and Kimsuky-Related Distribution Cases

The Funhouse ransomware campaign is attributed to a North Korean threat actor associated with Kimsuky. It distributes ransomware via malicious Korean-language documents disguised as resumes, using HWP files as the initial infection vector instead of previously used LNK files. The attack chain involves multi-stage scripting (Batch, VBS, PowerShell) that installs the Quasar RAT remote access trojan before executing the ransomware payload. Funhouse is a variant of the Endpoint ransomware family, maintaining core characteristics such as mutex values and batch file structures, while updating encryption extensions, contact information, and C2 infrastructure. This campaign shares significant technical similarities with earlier Kimsuky Endpoint ransomware operations observed in early 2026.

Successful infection results in deployment of ransomware that encrypts victim data, preceded by installation of Quasar RAT, which provides remote access to the attacker. This can lead to data loss, operational disruption, and potential further compromise via the RAT. The campaign targets Korean-speaking users using resume-themed lure documents. There are no known exploits or patches since this is malware distribution rather than a software vulnerability.

No official patches or fixes apply as this is a malware campaign. Mitigation should focus on user awareness to avoid opening suspicious Korean-language resume documents, especially HWP files. Endpoint detection and response solutions should monitor for multi-stage script execution involving Batch, VBS, and PowerShell, as well as indicators related to Quasar RAT and Funhouse ransomware. Blocking known malicious domains and IPs such as 'koocpt.site' and '70.36.97.236' can help reduce exposure. Regular backups and incident response readiness are recommended to mitigate ransomware impact.