SOC Prime Bias: Critical

08 Apr 2026 17:25
newspaper icon ASEC

Malicious LNK Files Distributing a Python-Based Backdoor and Changes in Distribution Techniques (Kimsuky Group)

Author Photo
SOC Prime Team linkedin icon Follow
Malicious LNK Files Distributing a Python-Based Backdoor and Changes in Distribution Techniques (Kimsuky Group)
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Kimsuky has shifted to malicious LNK attachments that kick off a multi-stage execution chain spanning PowerShell, XML Task Scheduler definitions, and VBS/PS1/BAT scripting before launching a Python-based backdoor. Recent waves add decoy documents, hide staging inside concealed directories, and abuse cloud services such as Dropbox for command flow and data theft. Once running, the backdoor communicates with a hard-coded IP using a custom protocol, supports remote command execution, drive discovery, and file exfiltration. The report highlights how the updated chain and infrastructure make the activity harder to spot with single-stage detections.

Investigation

AhnLab Security Intelligence Center analyzed current LNK samples and reconstructed the chain: an initial PowerShell stage drops artifacts, creates hidden directories, registers XML-based scheduled tasks, and then retrieves split ZIP fragments that assemble into the Python backdoor. Telemetry showed communications to 45.95.186.232:8080 and exfiltration activity leveraging Dropbox endpoints. Investigators also extracted detection-ready indicators including task names, filenames, and associated URLs used during staging and upload.

Mitigation

Block or restrict LNK execution from untrusted locations and email-derived paths. Monitor for creation of scheduled tasks with unusual naming patterns, especially where tasks execute script interpreters or user-writable binaries. Deny outbound access to 45.95.186.232:8080 and scrutinize Dropbox traffic for suspicious uploads or API usage tied to non-approved tooling. Apply file integrity monitoring to the hidden C:\windirr directory and alert on unexpected writes. Add endpoint coverage for PowerShell launching BAT, and wscript.exe execution of VBS in unusual parent/child chains.

Response

If indicators are observed, isolate the endpoint and halt scheduled tasks matching the identified patterns. Remove the hidden staging folder and all associated scripts/fragments, then perform a forensic review of executed commands and created task XML. Block the hard-coded C2 IP and any related domains at perimeter controls, and revoke/purge any Dropbox credentials or tokens used for exfiltration. Update detections with extracted IOCs and hunt across the environment for the same task + hidden-directory + script-chain behavior.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef malware fill:#ff6666 classDef file fill:#99ff99 classDef process fill:#ffcc99 classDef technique fill:#ff99ff %% Nodes u2013 Techniques initial_access["<b>Technique</b> – <b>T1027.012 LNK Icon Smuggling</b><br/><b>Description</b>: Hide malicious code within .lnk shortcut files."] class initial_access technique user_execution["<b>Technique</b> – <b>T1204.002 User Execution</b><br/><b>Description</b>: Victim runs malicious file manually."] class user_execution technique powershell_exec["<b>Technique</b> – <b>T1059.001 PowerShell</b><br/><b>Description</b>: Execute PowerShell interpreter."] class powershell_exec technique hidden_attrs["<b>Technique</b> – <b>T1564.001 Hidden Files and Directories</b><br/><b>Description</b>: Set hidden and system attributes on files or directories."] class hidden_attrs technique hidden_window["<b>Technique</b> – <b>T1564.003 Hidden Window</b><br/><b>Description</b>: Execute processes without a visible console window."] class hidden_window technique zip_obfuscation["<b>Technique</b> – <b>T1027.015 Archive Collected Data</b><br/><b>Description</b>: Compress payloads in split ZIP fragments for obfuscation."] class zip_obfuscation technique scheduled_task["<b>Technique</b> – <b>T1053 Scheduled Task</b><br/><b>Description</b>: Register a task that runs wscript.exe."] class scheduled_task technique account_discovery["<b>Technique</b> – <b>T1087 Account Discovery</b><br/><b>Description</b>: Enumerate local and domain accounts."] class account_discovery technique software_discovery["<b>Technique</b> – <b>T1592.002 Software Discovery</b><br/><b>Description</b>: Gather information about installed software."] class software_discovery technique config_repo["<b>Technique</b> – <b>T1602 Data from Configuration Repository</b><br/><b>Description</b>: Retrieve configuration data from system repositories."] class config_repo technique ingress_transfer["<b>Technique</b> – <b>T1105 Ingress Tool Transfer</b><br/><b>Description</b>: Transfer collected data to a remote server."] class ingress_transfer technique web_service["<b>Technique</b> – <b>T1102.003 Web Service Oneu2011Way Communication</b><br/><b>Description</b>: Use Dropbox as a oneu2011way exfiltration channel."] class web_service technique nonstandard_encoding["<b>Technique</b> – <b>T1132.002 Data Encoding Nonu2011Standard Encoding</b><br/><b>Description</b>: Encode C2 traffic with a custom scheme."] class nonstandard_encoding technique external_proxy["<b>Technique</b> – <b>T1090.002 Proxy External Proxy</b><br/><b>Description</b>: Relay traffic through an external proxy server."] class external_proxy technique %% Nodes u2013 Files and Artifacts malicious_lnk["<b>File</b> – Malicious .lnk shortcut disguised as a document"] class malicious_lnk file powershell_script["<b>File</b> – PowerShell script launched by the .lnk"] class powershell_script file hidden_folder["<b>File</b> – Hidden directory C:\windirr"] class hidden_folder file vbs_payload["<b>File</b> – VBS script registered via XML task"] class vbs_payload file python_backdoor["<b>File</b> – Python backdoor (beauty.py)"] class python_backdoor file xml_task["<b>File</b> – XML file that defines the scheduled task"] class xml_task file bat_script["<b>File</b> – BAT script that downloads, merges and extracts ZIP fragments"] class bat_script file tmp_ini["<b>File</b> – tmp.ini containing collected system data"] class tmp_ini file %% Nodes u2013 Processes process_wscript["<b>Process</b> – wscript.exe"] class process_wscript process process_powershell["<b>Process</b> – powershell.exe"] class process_powershell process process_python["<b>Process</b> – python.exe"] class process_python process %% Flow Connections malicious_lnk –>|delivered via phishing email| initial_access initial_access –>|executed by victim| user_execution user_execution –>|launches| powershell_script powershell_script –>|runs| powershell_exec powershell_exec –>|creates hidden directory| hidden_folder powershell_exec –>|drops VBS payload| vbs_payload powershell_exec –>|drops Python backdoor| python_backdoor powershell_exec –>|stores payloads in split ZIP fragments| zip_obfuscation powershell_exec –>|starts| process_powershell process_powershell –>|started with hidden window| hidden_window hidden_folder –>|attributes set by| hidden_attrs vbs_payload –>|attributes set by| hidden_attrs python_backdoor –>|attributes set by| hidden_attrs vbs_payload –>|registered via| xml_task xml_task –>|creates scheduled task| scheduled_task scheduled_task –>|executes| process_wscript process_wscript –>|runs VBS payload| vbs_payload vbs_payload –>|calls PowerShell script| powershell_script vbs_payload –>|calls Python backdoor| python_backdoor python_backdoor –>|performs| account_discovery python_backdoor –>|performs| software_discovery python_backdoor –>|performs| config_repo python_backdoor –>|writes data to| tmp_ini tmp_ini –>|uploaded using| ingress_transfer ingress_transfer –>|exfiltrates via| web_service web_service –>|communicates using| nonstandard_encoding nonstandard_encoding –>|may be relayed through| external_proxy bat_script –>|downloads ZIP fragments| zip_obfuscation bat_script –>|merges fragments and extracts XML task| xml_task bat_script –>|triggers scheduled task| scheduled_task %% Class Assignments class initial_access technique class user_execution technique class powershell_exec technique class hidden_attrs technique class hidden_window technique class zip_obfuscation technique class scheduled_task technique class account_discovery technique class software_discovery technique class config_repo technique class ingress_transfer technique class web_service technique class nonstandard_encoding technique class external_proxy technique class malicious_lnk file class powershell_script file class hidden_folder file class vbs_payload file class python_backdoor file class xml_task file class bat_script file class tmp_ini file class process_wscript process class process_powershell process class process_python process "

Attack Flow

Simulation Execution

Prerequisite: Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands

The Kimsuky threat actor drops two malicious files to the victim host:

  1. C:windirr11.vbs – a VBS script that writes a Python backdoor to %TEMP% and executes it.
  2. C:UsersPublicMusichh.bat – a batch file that launches the same Python payload via cmd.exe.

The attacker invokes these scripts directly using the native Windows script hosts to stay “living‑off‑the‑land”:

  • wscript.exe /b C:windirr11.vbs (silent execution)
  • cmd.exe /c C:UsersPublicMusichh.bat

Both executions generate a Process Creation event with the exact command lines the Sigma rule watches, thereby triggering the alert.

Regression Test Script

The script below reproduces the full attack chain (creates the files, writes minimal malicious payloads, executes them, and logs the expected telemetry).

# Kimsuky‑style VBS & BAT execution simulation
# ----------------------------------------------------------------
# 1. Create malicious VBS (11.vbs)
$vbspath = "C:windirr11.vbs"
$vbscode = @'
Dim objShell
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "cmd.exe /c echo python backdoor simulated > %TEMP%backdoor.py", 0, False
'@
New-Item -ItemType Directory -Force -Path (Split-Path $vbspath)
Set-Content -Path $vbspath -Value $vbscode -Encoding ASCII

# 2. Create malicious BAT (hh.bat)
$batpath = "C:UsersPublicMusichh.bat"
$batcode = '@echo off
echo python backdoor simulated > %TEMP%backdoor.py
'
New-Item -ItemType Directory -Force -Path (Split-Path $batpath)
Set-Content -Path $batpath -Value $batcode -Encoding ASCII

# 3. Execute VBS (silent)
Start-Process -FilePath "wscript.exe" -ArgumentList "/b `"$vbspath`"" -WindowStyle Hidden

# 4. Execute BAT
Start-Process -FilePath "cmd.exe" -ArgumentList "/c `"$batpath`"" -WindowStyle Hidden

# 5. Optional: give the analyst a moment to observe SIEM alerts
Start-Sleep -Seconds 10

Cleanup Commands

Run the following to remove artifacts and reset the environment.

# Remove malicious files
Remove-Item -Path "C:windirr11.vbs" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:UsersPublicMusichh.bat" -Force -ErrorAction SilentlyContinue
# Remove the simulated backdoor
Remove-Item -Path "$env:TEMPbackdoor.py" -Force -ErrorAction SilentlyContinue
# Clean up empty directories if they were created solely for the test
Remove-Item -Path "C:windirr" -Force -Recurse -ErrorAction SilentlyContinue
Remove-Item -Path "C:UsersPublicMusic" -Force -Recurse -ErrorAction SilentlyContinue

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free