INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Kimsuky Exploits Vulnerabilities via Multi-Path Delivery Attacks on Networks

| 2026-11-03 20:56 CRITICAL HIGH STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
The campaign attributed to APT-C-55 (Kimsuky) used three delivery paths targeting primarily South Korean victims, with additional Korean-, Japanese-, Vietnamese-, German-, and English-language lures. The methods included phishing emails carrying malicious LNK files, disguised shortcuts that executed PowerShell, and supply-chain poisoning of a cloned Python repository. Despite differing initial access techniques, the attacks shared persistence mechanisms, abuse of legitimate system utilities, staged payload delivery, and continuous collection of host and user information. MITRE ATT&CK: T1016, T1027, T1036, T1041, T1053.005, T1057, T1059.001, T1070.004, T1059.003, T1059.006 Targeted industries: Finance
Technical Mitigations AI-generated
• Use PowerShell execution policy to block the use of untrusted scripts (T1053.005). • Block supply-chain poisoning by monitoring legitimate system utilities and staged payload delivery. • Detect phishing emails carrying malicious LNK files using Windows Security logs. • Monitor for abuse of legitimate system utilities, such as certutilbase64 and bat9c2. • Use a secure Python repository to prevent supply-chain poisoning.
Technical Observables 22 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 22 IoCs Create Free Account
emails 11 domains 4 md5 6 urls 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
KimsukyKimsuky
Target & Sectors
Global Scope energyenergy
Incident Timeline
‎2026/11/03
The Kimsuky APT group used multiple delivery paths, including phishing emails and supply-chain attacks, to target primarily South Korean victims.
threat_actor Kimsuky
Kimsuky is a North Korean APT group, and one of its published campaigns impersonates diplomats to deliver LNK files and PowerShell droppers.
Those techniques leave traces in ordinary Windows Security logs: script hosts launched from user-writable folders, […] The post Kimsuky Detection and Exploitation Analysis appeared first on SOC Prime .
Kimsuky Detection and Exploitation Analysis.
infrastructure Windows
Those techniques leave traces in ordinary Windows Security logs: script hosts launched from user-writable folders, […] The post Kimsuky Detection and Exploitation Analysis appeared first on SOC Prime .
organisation Windows Security
Those techniques leave traces in ordinary Windows Security logs: script hosts launched from user-writable folders, […] The post Kimsuky Detection and Exploitation Analysis appeared first on SOC Prime .
organisation The post
Those techniques leave traces in ordinary Windows Security logs: script hosts launched from user-writable folders, […] The post Kimsuky Detection and Exploitation Analysis appeared first on SOC Prime .
organisation APT-C-55 (
Analysis of APT-C-55 (Kimsuky) Group’s Multi-Path Delivery Attack Campaign.. The campaign attributed to APT-C-55 (Kimsuky) used three delivery paths targeting primarily South Korean victims, with additional Korean-, Japanese-, Vietnamese-, German-, and English-language lures.
organisation LNK
The methods included phishing emails carrying malicious LNK files, disguised shortcuts that executed PowerShell, and supply-chain poisoning of a cloned Python repository.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Those techniques leave traces in ordinary Windows Security logs: script hosts launched from user-writable folders, […] The post Kimsuky Detection and Exploitation Analysis appeared first on SOC Prime .
Intelligence Sources
AlienVault OTX 2026-10-20
AlienVault OTX 2026-11-03