The request asked someone to review a seafood ingredient purchase for a Seoul hotel. Opening the attachment produced a perfectly ordinary Korean HWP document, the sort of form such a request would arrive with. While the recipient read it, a script was already writing itself to disk, registering a scheduled task, and deleting the file that started everything.
AhnLab's ASEC researchers published the case on September 1, 2026 and attribute it to Kimsuky, the North Korean espionage group its translated post renders as Kim Sukki. The file was distributed to users in South Korea under the name "[Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK".
The decoy document is real, and that is the point
An LNK file is a Windows shortcut. It is not supposed to carry content of its own, which is exactly why attackers keep hiding payloads inside one. When this shortcut runs, PowerShell extracts data from the file itself. Out comes a legitimate HWP document, written to the same folder and shown to the victim so nothing looks wrong, and an XOR-encrypted ZIP archive dropped to C:\ProgramData\systmp\sunshine.
The archive unpacks into a PowerShell script, termsvc.Ps1, and a JavaScript file, poc.Js, under C:\ProgramData\video. A second copy of the JavaScript is saved as ping_ followed by the first four characters of the machine UUID. Then the original LNK deletes itself, and the sunshine archive goes with it.
A task that wakes up every 14 minutes
Persistence comes from the Windows Task Scheduler. The task is registered under a name shaped like MicrosoftOffice2016_ plus those same four UUID characters, and fires roughly every 14 minutes through wscript.Exe. On each run the obfuscated JavaScript confirms termsvc.Ps1 is still present, bypasses the PowerShell execution policy, and runs the script hidden.
That script collects the operating system name and architecture, the system time zone, the public IP address (queried from api[.]ipify[.]org), the username and domain, the computer name, and the full running process list from tasklist.
The command channel is a cloud backup service
Where that data goes is the detail worth carrying away. termsvc.Ps1 authenticates to the Backblaze B2 API, retrieves bucket information, then builds a path keyed to the machine's BIOS serial number so every infected system gets its own folder. The collected data is converted to UTF-8 text and uploaded there.
The same folder is then read back. The script downloads a command file named "aaa" from its own path, writes it to the %TEMP% directory under an arbitrary name with a .Cmd extension, and executes it hidden through cmd.Exe /c. Roughly 120 seconds later the .Cmd file is deleted. Backblaze B2 is not being used as storage here. It is the command and control channel in both directions, wearing the network signature of a commercial backup product that plenty of organizations already allow.
Traces worth hunting for tonight
AhnLab links this to earlier Kimsuky LNK operations on more than the lure. The PowerShell execution syntax matches, as do the method of identifying the original LNK by file size, the fixed-offset extraction of embedded data, and the scheduled-task pattern used to re-run the script.
Defenders should look for scheduled tasks named MicrosoftOffice2016_ followed by four characters, JavaScript executed by wscript.Exe on a roughly 14-minute cycle, and the paths C:\ProgramData\systmp\sunshine, C:\ProgramData\video\termsvc.Ps1 and C:\ProgramData\video\poc.Js. Because several files are deleted during the attack, creation and deletion artifacts matter as much as surviving files. On the network side, look for Backblaze B2 authentication from hosts with no reason to talk to it, and for lookups to api[.]ipify[.]org.
Shortcut files became the single most common APT lure in South Korea this summer, and Kimsuky is a large part of why. The warning AhnLab closes on is worth repeating, because it inverts the instinct most people have: a legitimate document opening successfully is not evidence the file was safe. In this campaign, it is the cover story.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.