KimJongRAT Continues to Evolve by Leveraging LOTS

In May 2026, security researchers observed an attack campaign distributing KimJongRAT through GitHub and other legitimate services. KimJongRAT, used by the North Korean APT group Kimsuky since 2013, combines information stealing and remote access capabilities. The infection chain begins with phishing emails containing shortened URLs redirecting to GitHub Releases hosting malicious ZIP files. Victims execute LNK files that download HTA files from GitHub, which then retrieve subsequent payloads from Google Drive. Recent variants demonstrate significant evolution: they now dynamically fetch C2 addresses from external sources rather than hardcoding them, enabling operators to maintain persistent access despite infrastructure takedowns. Additionally, new versions include MeshAgent RMM installation for redundant access. The campaign exemplifies Living Off Trusted Sites (LOTS) techniques, abusing legitimate platforms like GitHub, Google Drive, and Dropbox to evade detection.

• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• RARLAB WinRAR · Gorbag: Orcs at the border harvesting intelligence from UkraineExploitedMalware2026-11-03
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• September 2026 Infostealer Trend ReportMalware2026-10-28