KimJongRAT, a malware linked to the North Korean APT group Kimsuky, continues to evolve as of May 2026. The malware combines information stealing and remote access capabilities. The infection vector starts with phishing emails containing shortened URLs that redirect to GitHub Releases hosting malicious ZIP files. Execution of LNK files leads to downloading HTA files from GitHub, which then fetch additional payloads from Google Drive. Recent variants no longer hardcode C2 addresses but dynamically retrieve them from external sources, allowing operators to maintain persistent access even if infrastructure is taken down. Additionally, the malware now installs MeshAgent RMM software to ensure redundant remote access. This campaign exemplifies LOTS techniques by leveraging trusted platforms such as GitHub, Google Drive, and Dropbox to bypass traditional detection methods. Indicators include multiple IPs, domains, URLs, and file hashes associated with the campaign. There is no CVE or patch available since this is malware distribution rather than a software vulnerability.

The malware enables attackers to steal information and maintain remote access to compromised systems. The dynamic retrieval of C2 addresses and installation of MeshAgent RMM increase the persistence and resilience of the threat actor's access. The use of legitimate platforms for hosting payloads complicates detection and mitigation efforts. The campaign targets victims via phishing and abuses trusted sites, increasing the likelihood of successful infection. The impact includes potential data exfiltration, system compromise, and long-term unauthorized access.

No official patch or fix is applicable as this is malware, not a software vulnerability. Defenders should focus on user awareness to prevent phishing infections, block known malicious indicators such as IP addresses, domains, URLs, and file hashes associated with this campaign, and monitor for execution of LNK and HTA files originating from untrusted sources. Network controls should restrict access to suspicious domains and URLs identified in the indicators. Endpoint detection and response (EDR) solutions should be tuned to detect behaviors related to KimJongRAT and MeshAgent installation. Since the malware uses LOTS techniques leveraging trusted platforms, defenders should apply enhanced scrutiny to downloads from GitHub Releases, Google Drive, and similar services. There is no vendor advisory or patch; remediation relies on detection and prevention controls.