KimJongRAT, used by the North Korean APT group Kimsuky since 2013, continues evolving as of May 2026. The infection chain starts with phishing emails containing shortened URLs that redirect to GitHub Releases hosting malicious ZIP files. Execution of LNK files downloads HTA files from GitHub, which then retrieve additional payloads from Google Drive. Recent variants no longer hardcode C2 addresses but dynamically fetch them from external sources, allowing operators to maintain persistent access despite infrastructure takedowns. New versions also install MeshAgent RMM software to ensure redundant remote access. The campaign exemplifies LOTS techniques by leveraging trusted platforms such as GitHub, Google Drive, and Dropbox to bypass traditional detection methods. Indicators include IP addresses, domains, URLs, and file hashes associated with the campaign. There is no official patch or CVE since this is malware, not a software vulnerability.

The malware enables attackers to steal information and maintain remote access to compromised systems. Dynamic retrieval of C2 addresses and installation of MeshAgent RMM increase persistence and resilience of the threat actor's access. Use of legitimate platforms for hosting payloads complicates detection and mitigation. The campaign targets victims via phishing and abuses trusted sites, increasing infection likelihood. Impact includes potential data exfiltration, system compromise, and long-term unauthorized access.

No official patch or fix is applicable as this is malware, not a software vulnerability. Defenders should focus on user awareness to prevent phishing infections, block known malicious indicators such as IP addresses, domains, URLs, and file hashes associated with this campaign, and monitor for execution of LNK and HTA files from untrusted sources. Network controls should restrict access to suspicious domains and URLs identified in the indicators. Endpoint detection and response (EDR) solutions should be tuned to detect behaviors related to KimJongRAT and MeshAgent installation. Enhanced scrutiny should be applied to downloads from GitHub Releases, Google Drive, and similar trusted services due to LOTS techniques. There is no vendor advisory or patch; remediation relies on detection and prevention controls.