Loading story…
Researchers reported a malicious Windows shortcut file, [별첨2]_인지시점_정정신고_추가_증적자료_FAQ.lnk, as likely tied to the North Korean threat actor Kimsuky. The lure appears crafted for administrative and oversight functions including insurance, finance, security, audit, legal, and general affairs teams, indicating a targeted phishing effort aimed at organizations handling sensitive internal records and compliance material.
Separate reporting highlighted an ENKI presentation analyzing North Korean APT attacks against domestic groupware environments and linked the activity to Kimsuky phishing operations, with references to malware and tooling including Gomir and HttpTroy. Together, the reports point to an ongoing espionage campaign in which Kimsuky uses socially engineered document-themed lures and groupware-focused intrusion tactics to reach organizational staff and compromise enterprise communications workflows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A Bluesky post shared an ENKI presentation titled "Analysis of North Korean APT Attacks Targeting Domestic Groupware," associating the material with Kimsuky, phishing, Gomir, and HttpTroy.
A Korean-language malware analysis post described a malicious LNK file named "[별첨2]_인지시점_정정신고_추가_증적자료_FAQ.lnk" and assessed it as likely associated with Kimsuky, with suspected targeting of insurance, finance, security, audit, legal, and general affairs teams.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked threat group **Kimsuky** has been reported using malicious Windows shortcut (`.LNK`) files to initiate a **multi-stage infection chain** that ends with deployment of a **Python-based backdoor**. Reporting shared from both AhnLab and Excalibra indicates the campaign relies on weaponized LNK files as the initial access vector, with the malware delivery process evolving from earlier distribution patterns. The activity was attributed to Kimsuky in threat-intelligence reporting and social media amplification, with references also linking the cluster to **DPRK** operations and possible overlap or comparison with **Konni** tracking. While the cited summaries did not include victimology or technical indicators, they consistently described a shift in how the group distributes malware and highlighted the use of LNK-based social engineering to stage follow-on payloads.
Jun 30, 2026
**Kimsuky**-linked malware delivered through malicious **LNK** files was observed targeting likely South Korean users, using shortcut execution to unpack a PowerShell-based implant, establish persistence via **Task Scheduler**, collect host information, and communicate through the **Dropbox API**. IIJ reported that the LNK extracts files into `C:\PerfLog`, deploys `www.ps1` and a VBScript launcher, creates a scheduled task named `P`, and drops a decoy document in a Hancom Office format. The malware generates a client ID from the victim MAC address, gathers system details including domain, username, OS version, process lists, and external IP address, then uploads the data to attacker-controlled Dropbox folders before attempting to download and run a follow-on batch payload. AhnLab's February 2026 APT trend reporting for South Korea provides broader context showing that **spear phishing** remained the dominant delivery method and that **LNK-based attacks** were the most prevalent format observed, including campaigns that used PowerShell to fetch additional components and register persistence. While AhnLab's report is a monthly trend overview rather than a dedicated write-up on the Dropbox variant, it aligns with IIJ's assessment that the malware shares substantial **TTP** overlap with previously reported **Kimsuky** activity. The reporting indicates continued abuse of legitimate cloud services such as **Dropbox** and, more broadly, GitHub and similar platforms to blend command-and-control and payload staging into normal network traffic.
Jun 30, 2026
North Korean state-backed threat group **Kimsuky** has been linked to an ongoing spear-phishing campaign targeting organizations and individuals in the United States, Europe, and Asia, including think tanks, research universities, government entities, and staff at Korea Risk Group. Researchers said the operation uses tailored phishing emails and **OneDrive-hosted password-protected documents** containing malicious Microsoft Office macros to gain initial access. The campaign delivers a new reconnaissance malware component dubbed **ReconShark**, assessed as an evolved variant of BabyShark. ReconShark gathers host data including running processes, battery status, and installed security products, then exfiltrates the information via HTTP `POST` requests without first writing it to disk. Based on the victim environment, the malware can also deploy follow-on payloads such as VBS, HTA, batch scripts, DLLs, malicious Office templates, and modified LNK files; supporting infrastructure was identified on NameCheap-hosted shared servers tied to domains including `yonsei[.]lol`, `rfa[.]ink`, `mitmail[.]tech`, and `newshare[.]online`.
Jun 29, 2026