Kimsuky Attack Disguised as Sex Offender Notification Information

In late July 2025, an organized APT attack using shortcut files was discovered, attributed to the North Korean Kimsuky group. The attackers distribute decoy zip files containing password-protected documents and a disguised shortcut file. When executed, it connects to a C2 server, downloads encrypted payloads, and performs various malicious activities. These include collecting sensitive information from browsers, cryptocurrency wallets, messaging apps, and system files. The collected data is encrypted and sent to the C2 server, which can issue additional commands for remote execution. The attack employs anti-VM techniques and establishes persistence through registry modifications. It also includes a separate malicious DLL for browser process injection.

• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto TiesMalware2026-09-19
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseCampaign2026-10-21