Follow 
Summary
The Kimsuky group is running spear-phishing campaigns that impersonate diplomatic personnel to target organizations in the education sector. The attacks use LNK files and PowerShell scripts to deliver multiple malware components, including the PebbleDash backdoor, PrxClient proxy, and RDP Wrapper. These tools enable remote access, privilege escalation, and data exfiltration from compromised systems.
Investigation
The investigation uncovered two separate attack cases. In the first case, LNK files executed PowerShell droppers that installed downloader scripts and system information-gathering components. In the second case, LNK files launched malicious HTA content through mshta.exe, which then established persistence by creating scheduled tasks.
Mitigation
Users should be extremely cautious with email attachments and executable files received from unknown or unverified sources. It is essential to confirm the legitimacy of any document or file before opening or running it. Organizations should also enforce strict controls on macro and script execution delivered through email channels.
Response
Security software should be updated to the latest version to reduce the risk of infection. If malicious activity is detected, affected systems should be isolated immediately to prevent further movement through RDP. A full forensic investigation should then be conducted to identify compromised accounts and determine whether data was exfiltrated.
Attack Flow
Detections
System Processes Execution from Untypical Paths (via process_creation)
Possible Remote Desktop Services Shadowing (via process_creation)
LOLBAS WScript / CScript (via process_creation)
Suspicious Execution from Public User Profile (via process_creation)
Suspicious Powershell Strings (via powershell)
Call Suspicious .NET Methods from Powershell (via powershell)
Suspicious Files in Public User Profile (via file_event)
Suspicious Windows DNS Query by Windows Script Host [wscript.exe] (via dns_query)
IOCs (HashMd5) to detect: APT Malware Attack Cases by the Kimsuky Group Impersonating Diplomats
IOCs (SourceIP) to detect: APT Malware Attack Cases by the Kimsuky Group Impersonating Diplomats
IOCs (DestinationIP) to detect: APT Malware Attack Cases by the Kimsuky Group Impersonating Diplomats
Kimsuky Group Spear Phishing and Malware Installation [Windows Process Creation]
Execution of PowerShell and Script Downloader by Kimsuky Group [Windows Powershell]
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
-
Attack Narrative & Commands: The adversary aims to establish a foothold and prepare for data exfiltration. Following a successful phishing lure, a script is dropped onto the system. The attacker executes a PowerShell command designed to run a specialized data collection script named
capture.Ps1. This specific filename is a known indicator of Kimsuky group activity. By calling this script through the PowerShell process, the attacker intends to bypass simple signature checks while executing their payload. -
Regression Test Script:
# Simulation script to trigger the detection rule by using a flagged filename. # This simulates the execution of a Kimsuky-style collection script. $TargetScript = "capture.Ps1" Write-Host "[+] Simulating Kimsuky activity by calling $TargetScript" # We execute powershell.exe with the specific string required by the detection logic Start-Process "powershell.exe" -ArgumentList "-ExecutionPolicy Bypass -File $TargetScript" -
Cleanup Commands:
# Cleanup: Remove any artifacts created during the simulation. Remove-Item -Path "capture.Ps1" -ErrorAction SilentlyContinue Write-Host "[+] Cleanup complete."
