5 minhigh
Kim Sooki again? This time, it was disguised as a request for seafood ingredients
A Kimsuky-associated phishing campaign targets Korean users with a malicious LNK file disguised as a seafood ingredient purchase request. Execution triggers a multi-stage attack involving a decoy HWP document, an obfuscated JavaScript payload, and a PowerShell script that exfiltrates system data to Backblaze B2 cloud storage and downloads further commands.
Sens:▲ 24hConf:high
Showing defanged values
- filenameC:\ProgramData\systmp\sunshinePath where the XOR-encrypted ZIP archive is temporarily saved during execution.
- filenameC:\ProgramData\video\poc.JsFinal drop location for the obfuscated JavaScript loader.
- filenameC:\ProgramData\video\termsvc.Ps1Final drop location for the PowerShell reconnaissance and C2 script.
- filenamepoc.JsObfuscated JavaScript file used to bypass PowerShell execution policy and execute the termsvc.Ps1 script.
- filename[RoyalHotelSeoul]RequestforReviewofSeafoodIngredientPurchases.LNKInitial access vector delivered via phishing; a malicious LNK file disguised as a legitimate HWP document.
- filenametermsvc.Ps1PowerShell script dropped to disk for system reconnaissance, data exfiltration to Backblaze B2, and secondary payload execution.
Detection / Hunteropenrouter
What Happened
A cyberattack targeting Korean organizations has been discovered, using a fake business document about seafood purchases to trick users. When the file is opened, it appears to be a normal document, but secretly installs a program that runs in the background every 14 minutes. This hidden program steals system information, uploads it to an external cloud service, and then downloads additional malicious commands. Organizations should be on the lookout for suspicious shortcut files and unexpected scheduled tasks.
Key Takeaways
- A malicious LNK file disguised as an HWP document targets Korean users under the guise of a seafood ingredient purchase request.
- The malware uses a scheduled task running every 14 minutes to maintain persistence and execute obfuscated JavaScript.
- Backblaze B2 cloud storage is abused as C2 infrastructure to exfiltrate system data and deliver additional payloads.
- AhnLab attributes this attack to the Kimsuky threat actor group based on shared code segments and behavioral patterns.
Affected Systems
- Microsoft Windows
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email delivers LNK file disguised as an HWP document.
- Execution: LNK runs PowerShell, extracts decoy HWP and XOR-encrypted ZIP to C:\ProgramData\systmp\sunshine.
- Persistence: Creates scheduled task to execute JS payload every 14 minutes via wscript.exe.
- Discovery & Collection: JS bypasses PS policy, runs termsvc.Ps1 to collect OS info, process list, IP, and user details.
- C2 & Exfiltration: Data uploaded to Backblaze B2 cloud storage using BIOS serial for path distinction.
- Execution & Cleanup: Downloads additional .cmd payload from B2, executes it, and deletes traces after 120 seconds.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article provides indicators of compromise and behavioral analysis but does not include specific YARA, Sigma, or Snort rules.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | EDR can capture process creation, command-line arguments, and file drops associated with LNK execution and subsequent script runs. |
| Network Visibility | Medium | Traffic to Backblaze B2 and IPify API is over HTTPS; visibility requires TLS inspection or proxy logging. |
| Detection Difficulty | Moderate | Relies on standard Windows scripting engines and cloud services; behavioral detection on scheduled task creation and unusual parent-child process relationships is key. |
Required Log Sources
- Windows Security Event Log (Process Creation - 4688)
- Sysmon (Event 1, 11, 3)
- Windows Task Scheduler Operational Log
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for wscript.exe spawning from scheduled task engine targeting files in C:\ProgramData. | Process creation logs (Sysmon Event 1, 4688) | Persistence | Low |
| Look for powershell.exe bypassing execution policy and writing files to C:\ProgramData. | Sysmon Events 1 and 11 | Execution | Medium |
| Look for cmd.exe executing .cmd files from %TEMP% directory shortly after script execution. | Process creation logs | Execution | Low |
Control Gaps
- Network-based DLP may miss exfiltration to legitimate cloud storage like Backblaze B2 if not explicitly configured to monitor it.
- Standard AV may miss LNK files or obfuscated scripts.
Key Behavioral Indicators
- wscript.exe executing JavaScript files in C:\ProgramData\video\ or similar paths
- Scheduled task named MicrosoftOffice2016_* created by non-admin process or via suspicious script
- Powershell downloading content and creating files in C:\ProgramData\systmp
False Positive Assessment
Low - The specific paths, file names, and scheduled task patterns are highly indicative of this specific attack campaign.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Consider blocking or isolating hosts with scheduled tasks matching the MicrosoftOffice2016_* pattern.
- Evaluate endpoint controls for presence of files in C:\ProgramData\systmp or C:\ProgramData\video paths.
Infrastructure Hardening
- Consider implementing network rules to restrict access to api.ipify.org if not required for business operations.
- Evaluate egress filtering policies to monitor or block unexpected uploads to Backblaze B2 endpoints.
User Protection
- Consider deploying endpoint detection rules for suspicious LNK file execution and PowerShell script dropping files to C:\ProgramData.
- Ensure endpoint protection can scan and intercept obfuscated JavaScript files.
Security Awareness
- Remind users to verify file extensions before opening attachments, especially LNK files disguised as documents.
- Advise users to be cautious of unsolicited purchase request documents, even if they appear to open correctly.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Discovery
Tactic
Exfiltration
Additional IOCs
- File Paths:
C:\ProgramData\systmp\sunshine- Path where the XOR-encrypted ZIP archive is temporarily saved during execution.C:\ProgramData\video\termsvc.Ps1- Final drop location for the PowerShell reconnaissance and C2 script.C:\ProgramData\video\poc.Js- Final drop location for the obfuscated JavaScript loader.
- Command Lines:
- Purpose: Execution of downloaded additional command file | Tools:
cmd.exe| Stage: Execution |cmd.exe /c - Purpose: Execution of JavaScript payload via Scheduled Task | Tools:
wscript.exe| Stage: Persistence |wscript.exe - Purpose: Process listing for reconnaissance | Tools:
tasklist| Stage: Discovery |tasklist
- Purpose: Execution of downloaded additional command file | Tools: