Live C2 Dump Recovering Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger

On April 11, 2026, researchers analyzed a CHM file (api_reference.chm) tagged as Kimsuky that initiated a three-stage attack chain. The C2 server at check[.]nid-log[.]com had directory listing enabled, allowing recovery of complete source code for all payload stages: a 6,338-byte VBScript performing system reconnaissance and establishing persistence via scheduled task, a 449-byte VBScript bridge to PowerShell, and a 6,234-byte PowerShell keylogger with clipboard monitoring and timed exfiltration. The infrastructure included 79+ domains across 5 C2 IPs spanning Korean VPS providers. The server responded with "Million OK !!!!" signature, matching previously documented Kimsuky infrastructure while showing upgraded Apache/PHP stack. The operation targeted Korean Naver users through credential phishing and tax authority impersonation, with infrastructure linked to previously documented Kimsuky campaigns via shared DAOU Technology subnets.

• Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructureCampaign2026-10-24
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of LockoutsCampaign2026-10-07
• Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock accessCampaign2026-10-06
• Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto TiesMalware2026-09-19