From Reconnaissance to Control: The Operational Blueprint of Kimsuky APT for Cyber Espionage

This report details a cyber-espionage campaign attributed to Kimsuky, a North Korean APT group, targeting South Korean entities. The attack uses malicious Windows shortcut files as initial access, followed by obfuscated scripts and a sophisticated malware framework. The malware performs extensive system profiling, steals credentials and sensitive documents, monitors user activity, and exfiltrates data over standard web traffic. It establishes persistence, evades detection, and maintains communication with command-and-control infrastructure. The campaign demonstrates Kimsuky's evolution in stealth, modularity, and targeting precision, representing a serious espionage threat that requires advanced behavioral monitoring and network anomaly detection to combat.

• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• Investigating a Multi-Stage PowerShell LoaderCampaign2026-08-10
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14