Kimsuky-Linked Campaigns Highlight Evolving Ransomware Distribution Tactics

Summary

The Kimsuky group has evolved its tactics by using malicious Hangul (HWP) documents disguised as resumes to distribute Funhouse ransomware. The multi-stage attack relies on embedded OLE objects that launch scripts to deploy Quasar RAT, which then installs the ransomware payload. The campaign represents a shift from previously observed LNK-based delivery to document-based initial access.

Investigation

AhnLab Security Intelligence Center analyzed the infection chain and found that the initial compromise begins with a malicious HWP file. Researchers observed sequential execution of Batch, VBS, and PowerShell scripts, followed by a Python-based backdoor and Quasar RAT. Analysis of Quasar RAT configuration files also revealed recurring mutex patterns and C2 communication characteristics shared across multiple campaigns.

Mitigation

Users should be cautious when opening unsolicited documents, especially resumes, and verify the legitimacy of embedded links before interacting with them. Organizations should apply the latest security updates to Hangul software and operating systems. Keeping endpoint security solutions such as V3 current is also important for detecting these multi-stage execution techniques.

Response

When malicious activity is detected, isolate affected endpoints to prevent lateral movement and the encryption phase of Funhouse ransomware. Perform a forensic review of the %TEMP% directory for suspicious .exe, .manifest, and .bat files. Monitor for unauthorized Quasar RAT configuration files with the .dwg extension and mutex patterns associated with the group’s activity.

Simulation Execution

• Attack Narrative & Commands: An adversary initiates a spear-phishing campaign using a Hangul word processor document named resume.Hwp. Upon opening, embedded OLE objects trigger the download and execution of a staged payload. To simulate the specific detection trigger, we will simulate the execution of the QuasarRAT.exe binary where the command line explicitly references the trigger file resume.Hwp. This mimics the Kimsuky group’s tactic of using document-based triggers to launch their RAT.

• Regression Test Script:

  # Simulation Script: Kimsuky Funhouse Distribution Trigger
  # This script creates a dummy binary and executes it with the specific command line required to trigger the rule.
  
  $DummyExe = "$env:TEMPQuasarRAT.exe"
  $TriggerFile = "resume.Hwp"
  
  # 1. Create a dummy executable to simulate the RAT
  New-Item -Path $DummyExe -ItemType File -Force
  # We use a simple 'echo' to make it an 'executable' for the sake of process creation telemetry
  Set-Content -Path $DummyExe -Value "This is a dummy binary for detection testing."
  
  # 2. Execute the dummy binary with the specific command line pattern defined in the Sigma rule
  # The rule looks for 'QuasarRAT.exe' AND 'resume.Hwp' in the command line
  Start-Process -FilePath $DummyExe -ArgumentList "/run /target $TriggerFile" -WindowStyle Hidden
  
  Write-Host "Simulation complete. Check SIEM for detection of QuasarRAT.exe with command line containing $TriggerFile"

• Cleanup Commands:

  # Cleanup Script
  Remove-Item -Path "$env:TEMPQuasarRAT.exe" -Force -ErrorAction SilentlyContinue
  Write-Host "Cleanup complete."