Follow Kimsuky detection depends on recognizing the group’s tradecraft in your own telemetry, not just on matching a hash. Kimsuky is a North Korean APT group, and one of its published campaigns impersonates diplomats to deliver LNK files and PowerShell droppers. Those techniques leave traces in ordinary Windows Security logs: script hosts launched from user-writable folders, hidden PowerShell, new services and scheduled tasks, and quiet account changes.
This article covers Kimsuky detection using a log sample analyzed in LogTotal, a log analysis tool that matches events to known threats. Below, we describe where the logs came from, what LogTotal flagged, which findings hold up against the raw events, and what the response should be.
Kimsuky Analysis
The tradecraft in this sample reads more clearly against the group’s background and its recent campaigns, so we start there before turning to the logs.
Who is Kimsuky
Kimsuky is a North Korean state-sponsored APT group focused on intelligence collection. MITRE ATT&CK tracks it as G0094, and vendors also call it APT43, Velvet Chollima, Black Banshee, THALLIUM, Emerald Sleet, TA427, and Springtail. Its activity is believed to align with North Korea’s Reconnaissance General Bureau.
CISA assesses that the group has most likely operated since 2012. The first detailed public report was Kaspersky’s “The Kimsuky Operation” in 2013, and the name comes from an internal code reference Kaspersky researchers found.
Most Kimsuky operations hit South Korea, with others reaching the United States, Japan, Europe, and Russia. Beyond government and policy targets, victims include academics and the cryptocurrency sector. Spear-phishing is its most observed entry point.
Kimsuky activity in 2026
| Period (2026) | Campaign | Tradecraft |
| October | Operation GitPower expansion (Genians) | Fake Zoom installers and PDF-themed LNK files against Ukrainian diplomacy and security experts; hidden PowerShell; scheduled-task persistence |
| Ongoing | Operation GitPower | ZIP archives with LNK files posing as documents, including embassy correspondence; obfuscated PowerShell; GitHub for staging and C2 |
| March–April | HTTPSpy variant (ENKI) | Spoofed security-software installer pages and a fake Cisco Webex page against South Korean military and corporate targets |
| 2025 to early 2026 | Groupware vendor compromise (ENKI WhiteHat) | Breached South Korean collaboration software vendors, then their customers |
The sample analyzed here dates from 21 September 2026, inside this period. Its dot-padded, PDF-themed LNK, hidden PowerShell, and logon-triggered scheduled task match these campaigns closely.
The log sample
The sample is a single file, Kimsuky.jsonl, with 3,087 events from one domain controller. It shows Kimsuky-style tradecraft executed against a DC in a controlled emulation, which makes it a useful reference for what this activity looks like in native Windows audit telemetry.
Log source and collection
| Attribute | Value |
| File | Kimsuky.jsonl |
| Events | 3,087 |
| Host | srv-ad-001.7logs.xyz, a domain controller in the 7logs domain |
| Time window | 21 September 2026, 15:02:41 to 15:05:58 UTC (just over three minutes) |
| Format | Native EVTX structure in JSON (Event → System / EventData, XML attributes under #attributes) |
The JSON layout points to an EVTX-to-JSON conversion rather than a SIEM-normalized export.
What the events contain
Most events are object and handle auditing (4658, 4656, 4663, 4690), token right adjustments (4703), and file share access (5145). These are high-volume and mostly background noise.
The detection-relevant events are far fewer:
- 49 process creations (4688) with full command lines
- Account and group management (4720–4738)
- Service installation (4697)
- Scheduled task lifecycle: created, updated, deleted (4698, 4702, 4699)
- Active Directory object changes (5136)
- Audit policy changes (4719)
Attack context: an emulation, not a live intrusion
The activity is clearly an emulation of Kimsuky tradecraft. Every attacker command has powershell_ise.exe as its parent process. Objects carry test names such as OrbitalTestSvc, adminuserz, and the password !BackdoorPass1. At the end, the operator removes the service, task, user, and group.
The techniques themselves mirror a published Kimsuky campaign in which the group impersonates diplomats and delivers LNK files and PowerShell droppers. That is why the telemetry is valuable: the behaviors are real even though the operator is not.
Detect Kimsuky
LogTotal processed all 3,087 lines in 16.4 seconds and matched 73 rules against 105 lines. It grouped those matches into 9 attack chains on one host, reported 8, and filtered out 1 at the AI verification step.
| Verdict field | Result |
| Verdict | Suspicious, needs investigation |
| Severity | Critical |
| Confidence | Medium |
How LogTotal’s rules map to raw Kimsuky evidence
| Fired rule | Raw evidence |
| Suspicious Execution from Public User Profile; Script Interpreter Execution From Suspicious Folder | LNK posing as a PDF with a dot-padded name (vvn.31.Pdf……Lnk); wscript.exe running DefenderUpdate.Js from C:\Users\Public\Downloads |
| The Possibility of Execution Through Hidden PowerShell Command Lines | powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File …\capture.Ps1 |
| Suspicious LOLBAS MSHTA Defense Evasion Behavior | mshta.exe running %TEMP%\D.21_SEOUL.hta |
| System Processes Execution from Untypical Paths | Fake smss.Exe under Public\Downloads\system32 |
| Suspicious Manipulation Of Default Accounts Via Net.EXE; Reg Add Suspicious Paths | net user administrator /active:yes; Administrator hidden via Winlogon\SpecialAccounts\UserList |
| PowerShell Scripts Installed as Services; Explicit COMSPEC Usage in Service File Path | Service OrbitalTestSvc launching hidden PowerShell |
| Suspicious Scheduled Task (via audit) | Logon-triggered task \OrbitalHealthCheck running svc_update.ps1 hidden |
| Suspicious ‘Admin’ Local User Creation with Net Command; User added to a group via commandline | adminuserz created and added to new group admingroupz |
| Event log cleared (native); Security Eventlog Cleared | Event 1102 by Administrator at 15:02:41 UTC |
Kimsuky IOCs and artifacts from this sample
The artifacts below come from an emulation, so the names themselves will not recur in the wild. The patterns behind them are what to hunt for.
| Artifact | Type | Pattern to hunt |
| vvn.31.Pdf……Lnk | LNK lure | Shortcut files posing as documents with dot-padded names |
| C:\Users\Public\Downloads\DefenderUpdate.Js | JScript run by wscript.exe | Script hosts launched from user-writable folders |
| capture.Ps1 | PowerShell script | -ExecutionPolicy Bypass -WindowStyle Hidden |
| %TEMP%\D.21_SEOUL.hta | HTA run by mshta.exe | MSHTA executing files from %TEMP% |
| Public\Downloads\system32\smss.Exe | Masquerading binary | System process names outside System32 |
| OrbitalTestSvc | Service (4697) | Services that launch hidden PowerShell via COMSPEC |
| \OrbitalHealthCheck → svc_update.ps1 | Scheduled task (4698) | Logon-triggered tasks running hidden scripts |
| adminuserz, admingroupz, !BackdoorPass1 | Account, group, password | New admin-like local accounts and groups created via net.exe |
| Winlogon\SpecialAccounts\UserList | Registry value | Accounts hidden from the logon screen |
| Event 1102 | Log clearing | Security log cleared before activity |
Kimsuky Mitigation
Contain the domain controller first, then rebuild trust in its accounts and logging. LogTotal’s response plan covers the essentials; because the target is a DC, the scope needs to widen to the domain.
LogTotal’s recommended response
- Isolate the host.
- Image memory and disk.
- Verify and remove the OrbitalHealthCheck scheduled task.
- Check and restore the audit policy.
- Enable PowerShell Script Block Logging and AMSI telemetry.
- Apply allowlisting for WScript, CScript, and PowerShell.
Additional steps for a domain controller
- Start the timeline at the 1102 event. The Security log was cleared at 15:02:41 UTC, so anything before it must come from other sources.
- Collect and hash everything in C:\Users\Public\Downloads\ and %TEMP%, including the LNK, JScript, PowerShell, HTA, and fake smss.Exe.
- Confirm cleanup. Verify that OrbitalTestSvc, adminuserz, and admingroupz are gone, and revert the Winlogon\SpecialAccounts\UserList value that hides Administrator.
- Reset credentials. Reset the Administrator password and plan a double krbtgt reset.
- Hunt domain-wide for dot-padded LNK file names and for script hosts (wscript.exe, cscript.exe, mshta.exe, powershell.exe) launched from user-writable folders.
Hardening against Kimsuky-style tradecraft
The same controls that catch this sample reduce exposure across the domain. Keep 4688 process creation with command lines enabled, since the 49 process events carried most of the evidence. Alert on 4697 service installs and 4698 task creations that launch hidden PowerShell. Treat any 1102 event on a DC as an incident trigger.
FAQ
What is Kimsuky and how does it operate?
Kimsuky is a North Korean state-sponsored espionage group, tracked by MITRE ATT&CK as G0094 and also known as APT43, Velvet Chollima, and Emerald Sleet. It typically gets in through tailored spear-phishing, then uses LNK files, scripts, and PowerShell to install backdoors and persistence for long-term intelligence collection. The analysis section above has the full profile.
When was Kimsuky first discovered?
CISA assesses that Kimsuky has most likely operated since 2012. The first detailed public report was Kaspersky’s “The Kimsuky Operation” in 2013, and the group’s name comes from an internal code reference Kaspersky researchers found.
What is the impact of a Kimsuky intrusion?
Kimsuky seeks long-term access for intelligence collection, including credential theft, and some of its operations also target the cryptocurrency sector. It has used compromised software vendors to reach their customers, as in its 2025 to early 2026 groupware campaign. On a domain controller, as in this sample, an attacker can create and hide administrator accounts and persist across the whole domain.
Can Kimsuky still affect me in 2026?
Yes. Kimsuky ran several campaigns in 2026, including Operation GitPower and an HTTPSpy wave against South Korean military targets. They use the same LNK lures, hidden PowerShell, and scheduled-task persistence seen in this sample. The analysis section lists the 2026 campaigns.
How can I protect myself from Kimsuky?
Allowlist or restrict WScript, CScript, and PowerShell, enable Script Block Logging and AMSI telemetry, and alert on script hosts running from user-writable folders. Monitor for new services and scheduled tasks that launch hidden PowerShell, and treat audit log clearing on a DC as an incident.
How can I detect Kimsuky?
Collect Windows Security events with process command lines (4688), service installs (4697), scheduled task events (4698, 4702, 4699), account and group changes (4720–4738), AD changes (5136), and log clearing (1102). Run the export through LogTotal to match it against known Kimsuky campaigns, then confirm each finding against the raw events.
