AhnLab Details Malicious Consent-Form LNKs in Activity Resembling Kimsuky

Summary

AhnLab details malicious consent-form LNK files that launch obfuscated PowerShell, run downloaded payloads in memory, establish scheduled-task persistence and collect system data. The activity resembles prior Kimsuky operations.

Key points

The LNK files are disguised as consent forms and execute obfuscated PowerShell when opened.
The PowerShell downloads additional scripts, which decrypt and execute code in memory; six variants were identified with the same general pattern.
A Windows Task Scheduler task repeatedly runs the loader, while a decoy document opens and the original LNK is deleted.
Information-stealing scripts collect installed security products, OS and network details, IP addresses, drive information, recently modified files and running processes.
A separate loader decrypts embedded executable data and loads it into memory as a backdoor.
The information-stealing behavior resembles prior Kimsuky cases; the article advises checking suspicious LNK files, scheduled tasks, PowerShell activity and external connections.

Article Details

Attack Vectors: Malicious LNK shortcuts disguised as consent forms prompt users to execute obfuscated PowerShell.
The PowerShell downloads additional scripts from external sources and executes payloads in memory.
A Windows Task Scheduler task repeatedly runs the loader to maintain persistence.
The LNK creates and opens a legitimate-looking decoy document, then deletes the original shortcut.
Defensive Notes: Verify file extensions, senders, and delivery paths before opening files, including files that appear to be work documents.
Check for suspicious Task Scheduler entries and unexpected files or PowerShell scripts in user account paths.
Review PowerShell execution logs, external connection logs, and scripts that run repeatedly.
Investigate connections to apparently legitimate web services or cloud storage when their patterns are unusual.

MITRE ATT&CK

T1005 · Data from Local SystemThe script collects recently modified files and running processes from infected PCs.T1016 · System Network Configuration DiscoveryThe information-theft script collects network settings and IP addresses from infected PCs.T1027 · Obfuscated Files or InformationThe scripts use obfuscated and encrypted PowerShell code that is decrypted before execution.T1053.005 · Scheduled TaskA Windows Task Scheduler task is registered to run the loader repeatedly, including after reboot.T1059.001 · PowerShellThe LNK launches obfuscated PowerShell, which downloads and executes additional scripts.T1082 · System Information DiscoveryThe information-theft script collects operating-system and drive information.T1105 · Ingress Tool TransferThe scripts download additional malicious PowerShell or payload data from external sources.T1204.002 · Malicious FileUsers are tricked into opening LNK shortcuts disguised as consent forms.

Threat Actors

KimsukyThe article says the information-theft script resembles patterns from past Kimsuky cases and describes the activity as linked to the group; it does not establish confirmed attribution.

Products

Microsoft WindowsThe campaign creates persistence through Windows Task Scheduler, drops decoy documents, and collects system details such as IP addresses and security product information, with behavior linked to the Kimsuky group.PowerShellthe Collection and Use of Personal Information” are being used to trick users into launching obfuscated PowerShell that downloads and runs additional payloads in memory.