New Kimsuky LNK Malware Using Multi-Channel C2 Infrastructure

Summary

The Kimsuky group is deploying a new LNK-based malware campaign disguised as domestic financial documents. The operation relies on a multi-channel Command and Control (C2) architecture that separates functions such as command delivery, infection notifications, and data exfiltration across trusted services including GitHub, WordPress, and Dropbox. This modular design helps the attackers evade traditional network defenses by abusing legitimate infrastructure and LOLBins.

Investigation

The investigation uncovered a multi-stage execution chain beginning with a malicious LNK file launched through conhost.exe. The attack abuses certutil.exe for decoding and downloading payloads and uses NirCmd for stealthy execution. The adversary also employs a Dead Drop technique through GitHub to distribute commands and uses MachineGuid values for unique victim identification and targeted task delivery.

Mitigation

Users should disable the Windows Explorer setting that hides extensions for known file types so disguised LNK files can be identified more easily. Organizations should monitor suspicious use of LOLBins such as certutil.exe and taskhostw.exe and enforce strict controls on unauthorized scheduled tasks. Anomalous outbound traffic to trusted services like GitHub or Dropbox should also be monitored for unusual communication patterns.

Response

If malicious activity is detected, the affected host should be isolated immediately to stop further data exfiltration or lateral movement. Responders should identify the system’s MachineGuid and investigate associated GitHub repositories used by the campaign. Scheduled tasks and registry keys should be reviewed for persistence, while unauthorized reverse tunnels established through Node.js, SSH, or similar tools should also be investigated.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has delivered a malicious .lnk file via a phishing email. When the user clicks the link, it executes a hidden command shell. The attacker’s goal is to decode a hidden payload stored in a seemingly innocent file. To achieve this while remaining stealthy, the attacker uses conhost.exe --headless to ensure no window pops up, and then invokes certutil.exe -decode to transform a Base64 encoded file into an executable. This sequence is a hallmark of Kimsuky group’s LNK-based delivery.

• Regression Test Script:

  # Simulation of Kimsuky LNK Malware TTPs
  # This script creates a dummy encoded file and then uses the specific combination 
  # required to trigger the detection rule.
  
  $dummyFile = "$env:TEMPencoded_payload.txt"
  $decodedFile = "$env:TEMPmalicious.exe"
  $base64Content = "SGVsbG8gV29ybGQh" # "Hello World!" in Base64
  
  # 1. Create the "encoded" file
  $base64Content | Out-File -FilePath $dummyFile -Encoding ascii
  
  # 2. Trigger the detection rule:
  # We need 'conhost.exe --headless' AND ('certutil.exe -decode' OR 'taskhostw.exe exec hide')
  # and the parent must NOT be 'dbg.exe'.
  
  Write-Host "[+] Simulating Kimsuky LNK execution sequence..."
  
  # Using Start-Process to simulate the way an LNK file would call the command line
  # Note: We simulate the conhost behavior via a direct command line argument
  Start-Process "conhost.exe" -ArgumentList "--headless", "cmd.exe", "/c", "certutil.exe -decode", "$dummyFile", "$decodedFile" -WindowStyle Hidden
  
  Write-Host "[+] Simulation command sent. Check SIEM for detection."

• Cleanup Commands:

  # Cleanup simulation artifacts
  Remove-Item -Path "$env:TEMPencoded_payload.txt" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPmalicious.exe" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete."