Loading story…
Kimsuky-linked malware delivered through malicious LNK files was observed targeting likely South Korean users, using shortcut execution to unpack a PowerShell-based implant, establish persistence via Task Scheduler, collect host information, and communicate through the Dropbox API. IIJ reported that the LNK extracts files into C:\PerfLog, deploys www.ps1 and a VBScript launcher, creates a scheduled task named P, and drops a decoy document in a Hancom Office format. The malware generates a client ID from the victim MAC address, gathers system details including domain, username, OS version, process lists, and external IP address, then uploads the data to attacker-controlled Dropbox folders before attempting to download and run a follow-on batch payload.
AhnLab's February 2026 APT trend reporting for South Korea provides broader context showing that spear phishing remained the dominant delivery method and that LNK-based attacks were the most prevalent format observed, including campaigns that used PowerShell to fetch additional components and register persistence. While AhnLab's report is a monthly trend overview rather than a dedicated write-up on the Dropbox variant, it aligns with IIJ's assessment that the malware shares substantial TTP overlap with previously reported Kimsuky activity. The reporting indicates continued abuse of legitimate cloud services such as Dropbox and, more broadly, GitHub and similar platforms to blend command-and-control and payload staging into normal network traffic.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A malware campaign disguised as the Korean Institute for Military Affairs publication "Monthly KIMA Military and Security" was identified using legitimate cloud services including Dropbox and GitHub to download and execute additional payloads. In its final stage, it established persistence by registering the initial VBE file as a scheduled task and collected reconnaissance data such as system information, Downloads folder contents, and running processes.
Researchers reported that Kimsuky launched a targeted campaign against prescription pharmaceutical companies using a malicious LNK file disguised as an Excel document. The multi-stage chain used XML, JavaScript, and PowerShell, established persistence via a fake Avast Secure Browser scheduled task, and used Dropbox API communications to exfiltrate host data and stage follow-on commands.
ASEC reported that Kimsuky updated its malicious LNK infection flow to add XML, VBS, and PowerShell stages while still delivering Python-based malware. The campaign used Dropbox for host-data exfiltration and follow-on BAT retrieval, and the deployed Python backdoor communicated with 45.95.186[.]232:8080 and supported command execution, file transfer, and payload execution.
IIJ Security Diary reported on Kimsuky malware that used the Dropbox API as part of its operation. No earlier event date is provided in the reference, so the publication date is used as the best estimate.
AhnLab reported that most APT attacks detected against South Korean targets in February 2026 were delivered through spear phishing, with LNK-based attacks the most common and CHM-based attacks also observed. The report described two LNK infection chains, including PowerShell-delivered AutoIt malware with Task Scheduler persistence and curl.exe retrieval of malicious HTA files from GitHub or Google Drive that deployed infostealer, keylogger, and backdoor loader components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
hauri.co.kr
Open sourcecybersecuritynews.com
Open sourcemedium.com
Open sourcecybersecuritynews.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourcesect.iij.ad.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked threat group **Kimsuky** has been reported using malicious Windows shortcut (`.LNK`) files to initiate a **multi-stage infection chain** that ends with deployment of a **Python-based backdoor**. Reporting shared from both AhnLab and Excalibra indicates the campaign relies on weaponized LNK files as the initial access vector, with the malware delivery process evolving from earlier distribution patterns. The activity was attributed to Kimsuky in threat-intelligence reporting and social media amplification, with references also linking the cluster to **DPRK** operations and possible overlap or comparison with **Konni** tracking. While the cited summaries did not include victimology or technical indicators, they consistently described a shift in how the group distributes malware and highlighted the use of LNK-based social engineering to stage follow-on payloads.
Jun 30, 2026
Attackers distributed malicious Windows shortcut (`.LNK`) files disguised as privacy consent forms and other work-related documents, tricking users into launching obfuscated PowerShell that fetched additional payloads from external infrastructure. Reporting indicates GitHub was used as a covert stage in the infection chain, helping operators blend malicious downloads and command retrieval into legitimate web traffic while keeping much of the activity fileless and in memory. Once executed, the malware created downloader and loader scripts, established persistence through Windows Task Scheduler, opened decoy documents to reduce suspicion, and deleted the original shortcut to limit forensic artifacts. Observed follow-on payloads included an information stealer and a backdoor loader that decrypted and loaded malware into memory; the theft activity gathered host, security product, network, IP, drive, file, and process data, with behavior resembling prior **Kimsuky**-linked operations.
Jun 29, 2026
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026