Kimsuky Linked to Malicious LNK Phishing and Groupware-Focused Intrusions

Researchers reported a malicious Windows shortcut file, [별첨2]_인지시점_정정신고_추가_증적자료_FAQ.lnk, as likely tied to the North Korean threat actor Kimsuky. The lure appears crafted for administrative and oversight functions including insurance, finance, security, audit, legal, and general affairs teams, indicating a targeted phishing effort aimed at organizations handling sensitive internal records and compliance material.

Separate reporting highlighted an ENKI presentation analyzing North Korean APT attacks against domestic groupware environments and linked the activity to Kimsuky phishing operations, with references to malware and tooling including Gomir and HttpTroy. Together, the reports point to an ongoing espionage campaign in which Kimsuky uses socially engineered document-themed lures and groupware-focused intrusion tactics to reach organizational staff and compromise enterprise communications workflows.