Aryaka Threat Research Labs researchers documented in a report published on Aryaka a Kimsuky (APT43, Thallium, Velvet Chollima) cyber-espionage campaign targeting South Korean government agencies, defense contractors, and research organizations — combining malicious Windows shortcut (LNK) files as initial access with a multi-stage PowerShell-based malware framework engineered for stealth, persistence, comprehensive system profiling, credential theft, keylogging, and segmented data exfiltration over standard web traffic.
Initial Access: LNK Files Delivering HTA via mshta.exe
The campaign distributes malicious .lnk files — likely via spam emails carrying ZIP-archived attachments — using lure documents repurposed from authentic South Korean government materials, including public safety notifications and local tax penalty notices. When executed, the LNK file launches mshta.exe to load a remotely hosted HTA file from an attacker-controlled CDN. HTA files execute with full system privileges, granting direct file system and registry access. The HTA contains heavily obfuscated VBScript where each line is constructed from decimal and hexadecimal values processed through the CLng function and arithmetic operations, then converted to readable characters via Chr — a static detection bypass that hinders manual analysis.
Multi-Stage Payload Deployment
Before proceeding, the VBScript checks whether Windows Defender is running via cmd /c sc query WinDefend. If Defender is active, the script uses curl to download a Base64-encoded file (zip.log) to AppData\Local, decodes it with certutil to produce pipe.zip, deletes zip.log, and extracts the archive via PowerShell's Expand-Archive. The extracted pipe directory contains four components:
- 1.log: Base64-encoded PowerShell stealer script targeting sensitive files and credentials.
- 2.log: Base64-encoded PowerShell keylogger script.
- 1.ps1: Decoder/executor — reads a Base64-encoded file passed as input, decodes it, and executes it via
Invoke-Expression. - 1.vbs: VBScript launcher that silently invokes
1.ps1with both1.logand2.logas parameters, passing execution policy bypass flags.
The stealer component performs extensive system profiling, harvests credentials, and collects sensitive documents. The keylogger monitors user activity and captures clipboard content. Both components communicate with C2 infrastructure at ygbsbl.hopto.org over standard HTTP/HTTPS traffic, uploading stolen data in discrete segments to blend with normal network activity. The C2 also supports download of additional payloads and execution of remote commands, maintaining real-time operator interaction with compromised hosts.
Persistence, Anti-Analysis, and Evasion
The framework enforces single-instance execution to prevent duplicate process detection and implements anti-virtualization checks to avoid sandbox environments. Persistence is established via standard Windows mechanisms. The malware's abuse of legitimate system utilities — mshta.exe, certutil, curl, and PowerShell with execution policy bypass — reflects Kimsuky's consistent TTP of living-off-the-land execution to evade signature-based detection. Reflective DLL injection is also employed in later stages to load sys.dll without writing to disk in a detectable manner.
Attribution and Victimology
Attribution to Kimsuky rests on multiple converging indicators: the targeting of South Korean government and institutional recipients with region-specific official document lures; the PowerShell-heavy execution chain matching Kimsuky's established TTPs; and corroborating reports from Seqrite (April 2025) and security researcher Emmy Byrne (March 2025) identifying related samples using the same lure documents. Active since at least 2012 under designations including APT43, Thallium, and Velvet Chollima, Kimsuky operates as a key North Korean state-sponsored cyber-espionage unit extracting geopolitical, military, and economic intelligence in support of Pyongyang's foreign policy and defense planning priorities.