A malicious LNK file disguised as a seafood ingredient purchase request was used to deliver a decoy HWP document while PowerShell, scheduled tasks, and external communications ran in the background. The attack exfiltrated system information, fetched additional commands from Backblaze B2, and was linked by AhnLab to Kimsuky. #Kimsuky #BackblazeB2 #AhnLab #RoyalHotelSeoul
Keypoints
- The attack used a malicious LNK file named “[Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK” to impersonate a legitimate business document.
- When opened, it displayed a decoy HWP document while secretly running PowerShell and preparing follow-on files in the background.
- The malware created and used files such as
termsvc.Ps1andpoc.Js, with encrypted ZIP data stored underC:ProgramDatasystmpsunshine. - A scheduled task named in the format
MicrosoftOffice2016_repeatedly launched JavaScript viawscript.Exeat roughly 14-minute intervals. termsvc.Ps1collected system information including OS details, timezone, public IP, username, domain, processes, and computer name, then uploaded it through Backblaze B2.- The script later downloaded an additional command file named
aaa, executed it viacmd.Exe /cin hidden mode, and deleted traces afterward. - AhnLab reported strong similarities to prior Kim Sukki/Kimsuky LNK attacks and attributed the activity to Kimsuky.
MITRE Techniques
- [T1204.002 ] User Execution: Malicious File – The victim had to open the disguised LNK file to start the attack (‘When the file is opened, a normal hwp document appears’).
- [T1027 ] Obfuscated Files or Information – The JavaScript was obfuscated to hinder analysis (‘This JavaScript is subject to obfuscation’).
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence was achieved by registering a task to run the script every 14 minutes (‘registers a scheduled task … execute ping_.Js approximately every 14 minutes’).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell was used to extract data, bypass execution policy, and run hidden scripts (‘it uses PowerShell to extract internal data’ and ‘bypasses the PowerShell execution policy to run the script in hidden mode’).
- [T1059.007 ] Command and Scripting Interpreter: JavaScript – The threat actor used a JavaScript file as part of the execution chain (‘The ZIP file contains … a JavaScript file named poc.Js’ and ‘execute ping_.Js’).
- [T1105 ] Ingress Tool Transfer – Additional script/command content was downloaded from Backblaze B2 (‘downloads an additional command file named aaa’).
- [T1041 ] Exfiltration Over C2 Channel – System information was uploaded to an external Backblaze B2 path used as C2 (‘it converts the collected data … and uploads it to that Path’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – The malware communicated with external web services and cloud APIs such as Ipify and Backblaze B2 (‘querying api.Ipify.Org’ and ‘authenticates with the Backblaze B2 API’).
- [T1070.004 ] File Deletion – The malware deleted its LNK and other traces after execution (‘deleting the LNK file used for initial distribution’).
- [T1560 ] Archive Collected Data – Data was packaged before upload via UTF-8 conversion and placed into a path associated with infected systems (‘converts the collected data into UTF-8 text data and uploads it’).
- [T1057 ] Process Discovery – The script collected the list of running processes using tasklist (‘the list of running processes is collected using the tasklist command’).
- [T1016 ] System Network Configuration Discovery – The malware gathered the public IP address to identify the infected host (‘The public IP address is verified by querying api.Ipify.Org’).
Indicators of Compromise
- [File name ] malicious initial lure and decoy-related files –
[Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK,termsvc.Ps1, and other related files - [File path ] dropped/extracted locations used by the malware –
C:ProgramDatasystmpsunshine,C:ProgramDatavideotermsvc.Ps1, andC:ProgramDatavideopoc.Js - [File/path pattern ] scheduled-task and script execution artifacts –
C:ProgramDatasystmpping_.JsandMicrosoftOffice2016_ - [Domain ] external IP-check and cloud C2 endpoints –
api.Ipify.Org, Backblaze B2 API - [Command ] execution and discovery commands used during the intrusion –
tasklist,cmd.Exe /c, andwscript.Exe - [File extension/type ] additional payload and command artifacts –
.Cmdfiles created in%TEMP%and deleted afterward
Read more: https://asec.ahnlab.com/en/95217/