Kimsuky Uses Legitimate RMM Tools in Northeast Asia Campaigns

Summary

Kimsuky threat actors are conducting spear-phishing campaigns against targets in South Korea and Japan using OneDrive-hosted LNK files. Once executed, the malware establishes persistence through scheduled tasks and retrieves PowerShell scripts to steal system information, emails, and keystrokes. The attackers also abuse legitimate remote control tools such as Chrome Remote Desktop and AnyDesk to maintain access while blending with normal administrative activity.

Investigation

The investigation uncovered a multi-stage infection chain involving malicious LNK files, obfuscated VBScript, and PowerShell scripts. Researchers analyzed specialized components including a malicious Chrome extension designed to collect Gmail data and scripts used to install AnyDesk. Korean-language comments and debug strings found in AI-generated code also suggest that the operators may be using generative AI during development.

Mitigation

Users should exercise caution when opening LNK files or links received from unknown sources, especially because Windows can hide file extensions. Organizations should regularly audit installed software for unauthorized Chrome Remote Desktop or AnyDesk deployments. Monitoring browser extensions for excessive or unexpected permissions is also strongly recommended.

Response

If Kimsuky activity is detected, security teams should review scheduled tasks for suspicious entries launching wscript.exe or powershell.exe. Unexpected AnyDesk processes and files located in %appdata% directories should also be investigated. Browser extensions and remote desktop configurations should be reviewed to identify and remove unauthorized access mechanisms.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained an initial foothold on the Windows workstation via a spear-phishing attachment. To establish Command and Control (C2) and begin the exfiltration of system information, the attacker executes a PowerShell one-liner. This script is designed to mimic the Kimsuky group’s known behavior: contacting a specific PHP endpoint on a compromised server to receive further instructions. The goal is to blend in with standard web traffic while hitting the precise C2 endpoint identified by threat intelligence.

• Regression Test Script:

  # Kimsuky C2 Simulation Script
  # This script simulates a request to one of the hardcoded URLs in the detection rule.
  
  $c2_url = "http://103.77.242.187/view.php?type=apple&seed=simulation_test"
  $user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
  
  Write-Host "[!] Simulating Kimsuky C2 Communication to: $c2_url"
  
  try {
      # Using Invoke-WebRequest to generate proxy-level HTTP traffic
      $response = Invoke-WebRequest -Uri $c2_url -UserAgent $user_agent -Method Get -ErrorAction Stop
      Write-Host "[+] Request completed. Status Code: $($response.StatusCode)"
  } catch {
      Write-Host "[-] Request failed (Expected if the IP is not live): $($_.Exception.Message)"
  }

• Cleanup Commands:

  # No persistent files were created; no cleanup required.
  # If a file was downloaded, use: Remove-Item -Path "C:pathtomalicious_file.exe" -Force
  Write-Host "[*] Simulation cleanup complete."