AhnLab Links Seafood-Themed Malicious LNK Attack to Kimsuky
Summary
AhnLab analyzes a malicious LNK disguised as a seafood purchase request that displays a decoy HWP document, runs scripts on a 14-minute schedule, sends system data through Backblaze B2, and retrieves follow-up commands.
Key points
- The LNK uses PowerShell to display a decoy HWP document while extracting and installing scripts in the background.
- A scheduled task runs an obfuscated JavaScript file about every 14 minutes; it launches a PowerShell script in hidden mode.
- The PowerShell script collects system details, including OS information, username, domain, public IP, and running processes.
- The script uses Backblaze B2 to upload collected data and retrieve additional commands for execution.
- The malware deletes some files, including the original LNK and intermediate data, to reduce traces.
- AhnLab links the activity to Kimsuky based on similarities to previously observed malicious LNK attacks.
- AhnLab recommends checking for suspicious MicrosoftOffice2016_ scheduled tasks, related files and paths, command execution, and Backblaze B2 communications.
Article Details
- Attack Vectors
- A malicious LNK disguised as a seafood ingredient purchase-review document was distributed to users in Korea.
- Opening the LNK displayed a legitimate HWP decoy while preparing and running malicious scripts in the background.
- A scheduled task repeatedly ran an obfuscated JavaScript file through wscript.exe, which launched a PowerShell script.
- The PowerShell script collected system information, uploaded it to Backblaze B2, and downloaded and executed additional commands.
- Defensive Notes
- Check for receipt, saving, or execution of the LNK file named '[Royal Hotel Seoul] Request for Review of Seafood Ingredient Purchases.LNK' or a similarly named file.
- Inspect for scheduled tasks named in the 'MicrosoftOffice2016_' format that run JavaScript through wscript.exe approximately every 14 minutes.
- Check for the reported paths C:\ProgramData\systmp\sunshine, C:\ProgramData\systmp\ping\_.Js, C:\ProgramData\video\termsvc.Ps1, and C:\ProgramData\video\poc.Js, including traces of file creation and deletion.
- Inspect %TEMP% for arbitrarily named .Cmd files and check for cmd.exe /c execution and subsequent file deletion.
- Review Backblaze B2 authentication and communications, queries to api.Ipify.Org, tasklist execution, and traces of system-information collection.
- Treat LNK files from unclear sources cautiously even if they open a legitimate-looking document; verify file format and execution path and monitor PowerShell, wscript.exe, cmd.exe, and external cloud-service activity.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript is described as obfuscated.T1033 · System Owner/User DiscoveryThe script collects the username and domain from the infected system.T1053.005 · Scheduled TaskThe malware registers a scheduled task to run the JavaScript approximately every 14 minutes.T1057 · Process DiscoveryThe script collects running-process information using tasklist.T1059.001 · PowerShellThe LNK uses PowerShell to extract data and run the malicious script.T1059.003 · Windows Command ShellThe downloaded command file is executed using cmd.exe /c.T1059.007 · JavaScriptThe scheduled task runs the JavaScript file through wscript.exe.T1070.004 · File DeletionThe malware deletes the initial LNK, an intermediate file, and the locally stored command file after execution.T1082 · System Information DiscoveryThe PowerShell script collects the infected system's operating-system name and architecture.T1105 · Ingress Tool TransferThe script downloads an additional command file named aaa from the system-specific Backblaze B2 path.T1204.002 · Malicious FileThe user runs a malicious LNK disguised as a seafood ingredient purchase-review document.T1567.002 · Exfiltration to Cloud StorageThe script uploads collected information to Backblaze B2, which the article identifies as cloud storage used for C2 and exfiltration.