Kimsuky Uses Malicious LNK Files to Deliver Python Backdoor
Threat Actor Intelligence · 4 sources · Updated 4mo ago · First seen Apr 5, 2026
North Korea-linked threat group Kimsuky has been reported using malicious Windows shortcut (.LNK) files to initiate a multi-stage infection chain that ends with deployment of a Python-based backdoor. Reporting shared from both AhnLab and Excalibra indicates the campaign relies on weaponized LNK files as the initial access vector, with the malware delivery process evolving from earlier distribution patterns.
The activity was attributed to Kimsuky in threat-intelligence reporting and social media amplification, with references also linking the cluster to DPRK operations and possible overlap or comparison with Konni tracking. While the cited summaries did not include victimology or technical indicators, they consistently described a shift in how the group distributes malware and highlighted the use of LNK-based social engineering to stage follow-on payloads.
