Threats Tagged 'korean targets'

Funhouse ransomware, distributed by a North Korean threat actor linked to Kimsuky, uses malicious Korean-language resume documents to infect targets. It is a variant of the Endpoint ransomware family, employing multi-stage scripts (Batch, VBS, PowerShell) to install Quasar RAT before deploying ransomware. The campaign shows strong similarities to earlier Kimsuky Endpoint operations, with updates in encryption extensions, contact info, and command-and-control infrastructure. The initial infection vector shifted from LNK files to HWP documents. No known exploits in the wild or patches are applicable as this is malware distribution.