Trojan.Agent.LNK.Gen

Trojan.Agent.LNK.Gen is a malware family used in spear-phishing campaigns attributed to North Korea-linked APT groups, particularly Kimsuky. It is typically delivered via malicious LNK files embedded in password-protected ZIP archives sent through spoofed emails. The malware leverages social engineering, often impersonating media or diplomatic staff, to target sectors such as diplomacy, finance, technology, media, and policy research, with notable campaigns against South Korean policy research institutes and European embassies in South Korea. Upon execution, the LNK file triggers PowerShell scripts that download additional payloads, including RATs like XenoRAT, and bait documents from cloud-based C2 infrastructure (e.g., GitHub, Dropbox, pCloud). The malware achieves persistence by registering scheduled tasks (e.g., every 30 minutes) and employs techniques such as in-memory payload loading, Base64-encoded PowerShell, .NET Assembly Reflection, and fileless operation. No exploitation of software vulnerabilities has been observed; instead, the campaigns rely on legitimate cloud services for C2 and evasion. The technical sophistication includes steganography, multilingual lures, and targeting of macOS and cryptocurrency wallets, indicating broad espionage objectives. The campaigns are consistent with Kimsuky's established TTPs and demonstrate ongoing expansion and adaptation of North Korean APT operations.