Phishing Emails Impersonate Seafood Purchase Requests to Deliver Malware

Summary

The Kimsuky threat actor is using malicious LNK files disguised as business documents to target users in South Korea. When executed, the LNK file launches a PowerShell script that deploys additional malware, including JavaScript and PowerShell components, through a hidden background process. The malware exfiltrates system information to Backblaze B2 storage and receives additional commands through the same cloud infrastructure.

Investigation

AhnLab identified the campaign by analyzing the malicious LNK file and its use of PowerShell and scheduled tasks for persistence. The investigation showed that the malware uses XOR encryption to conceal its payload and abuses legitimate cloud services such as Backblaze B2 for Command and Control (C2) and data exfiltration. Similarities in execution syntax and task scheduling connect the activity to previous Kimsuky campaigns.

Mitigation

Users should avoid opening LNK files received through email, even when they appear to be legitimate business documents. Organizations should restrict suspicious LNK execution and monitor for abnormal PowerShell or wscript.exe activity. Monitoring unauthorized communication with cloud storage services such as Backblaze B2 can also help detect potential malware activity and data exfiltration.

Response

If malicious activity is detected, administrators should identify and isolate affected hosts by checking for suspicious scheduled tasks and files in C:\ProgramData. Investigators should analyze the %TEMP% directory for deleted .cmd files and review system logs for tasklist command execution. Outbound connections to api.ipify.org or Backblaze B2 from unexpected processes should also be investigated.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully established a foothold on a Windows workstation. To prepare for exfiltration, the attacker first needs to determine their external IP address to configure their command-and-control (C2) listener and ensure they know which egress point is being used. They use ipify.org for this. Following discovery, the attacker attempts to stage sensitive documents and initiates a connection to the Backblaze B2 API to upload the stolen data, leveraging a legitimate cloud service to blend in with normal business traffic.

• Regression Test Script:

  # Simulation of IP Discovery and Backblaze API Connection
  Write-Host "[+] Starting Simulation: IP Discovery..." -ForegroundColor Cyan
  try {
      $ip = Invoke-RestMethod -Uri "https://api.ipify.org"
      Write-Host "[+] Successfully retrieved public IP: $ip" -ForegroundColor Green
  } catch {
      Write-Host "[-] IP Discovery failed." -ForegroundColor Red
  }
  
  Write-Host "[+] Starting Simulation: Backblaze B2 API Connection..." -ForegroundColor Cyan
  try {
      # Simulating an API call to Backblaze B2
      $backblazeUri = "https://api.backblazeb2.com/b2api/v2/b2_authorize_account"
      $response = Invoke-WebRequest -Uri $backblazeUri -Method Post -Body "{}" -ContentType "application/json"
      Write-Host "[+] Successfully contacted Backblaze API." -ForegroundColor Green
  } catch {
      Write-Host "[-] Backblaze connection failed (this is expected if no valid auth is used, but the network telemetry should still trigger)." -ForegroundColor Yellow
  }

• Cleanup Commands:

  # No persistent artifacts are created by this network-based simulation.
  Write-Host "[+] Simulation complete. No system changes made." -ForegroundColor Green