Kimsuky LNK Malware Using Dropbox API for Host Profiling and Payload Delivery

Kimsuky-linked malware delivered through malicious LNK files was observed targeting likely South Korean users, using shortcut execution to unpack a PowerShell-based implant, establish persistence via Task Scheduler, collect host information, and communicate through the Dropbox API. IIJ reported that the LNK extracts files into C:\PerfLog, deploys www.ps1 and a VBScript launcher, creates a scheduled task named P, and drops a decoy document in a Hancom Office format. The malware generates a client ID from the victim MAC address, gathers system details including domain, username, OS version, process lists, and external IP address, then uploads the data to attacker-controlled Dropbox folders before attempting to download and run a follow-on batch payload.

AhnLab's February 2026 APT trend reporting for South Korea provides broader context showing that spear phishing remained the dominant delivery method and that LNK-based attacks were the most prevalent format observed, including campaigns that used PowerShell to fetch additional components and register persistence. While AhnLab's report is a monthly trend overview rather than a dedicated write-up on the Dropbox variant, it aligns with IIJ's assessment that the malware shares substantial TTP overlap with previously reported Kimsuky activity. The reporting indicates continued abuse of legitimate cloud services such as Dropbox and, more broadly, GitHub and similar platforms to blend command-and-control and payload staging into normal network traffic.