Kimsuky-Linked Campaign Delivers Funhouse Ransomware Through Malicious Resume Document
Summary
AhnLab details a Kimsuky-linked campaign that uses a malicious Hangul resume document to deliver Quasar RAT and Funhouse ransomware, a variant of Endpoint ransomware, through a multi-stage script-based infection chain.
Key points
- The initial HWP resume contains malicious OLE data and a link; the infection proceeds when the user clicks the link.
- Batch, VBS, and PowerShell scripts download and execute successive payloads, including a portable Python-based backdoor.
- The chain installs Quasar RAT, which is used to execute Funhouse ransomware.
- Quasar RAT shares configuration traits with samples from earlier Endpoint ransomware cases, including a previously seen mutex.
- Funhouse retains several characteristics of Endpoint ransomware but uses different encryption details and threat-actor contact information.
- AhnLab assesses that the campaign is linked to Kimsuky based on similarities to its earlier distribution cases; the group’s delivery method has shifted from LNK files to HWP documents.
- AhnLab advises checking links in work documents and applying current software and operating-system security updates.
Article Details
- Attack Vectors
- A malicious Hangul document disguised as a resume contains embedded OLE data that drops files and scripts; subsequent malicious activity begins when the user clicks a hyperlink in the document.
- A multi-stage chain of Batch, VBS, and PowerShell scripts downloads and executes additional payloads, installs Quasar RAT, and ultimately runs Funhouse ransomware.
- The article says the attackers used the Quasar RAT configuration file to store C2 address and target-identification information.
- Defensive Notes
- Verify the source and credibility of hyperlinks in work-related documents and do not open suspicious links.
- Apply the latest security patches to Hangul software and operating systems, and keep V3 updated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | daejin[.]makeway2017[.]gethompy[.]com | Malicious payload-download host used by the batch script. |
| DOMAIN | koocpt[.]site | Malicious download host used by the batch script to retrieve an archive. |
| DOMAIN | pygrab[.]xyz | Malicious download host used by the batch script to retrieve a payload. |
| DOMAIN | toyless[.]shop | Malicious download host used by the batch script to retrieve an archive. |
| IPV4 | 45[.]43[.]60[.]53 | C2 address listed in a Quasar RAT configuration from a June 2026 Endpoint ransomware case. |
| IPV4 | 45[.]95[.]186[.]232 | C2 address listed in a Quasar RAT configuration from a February 2026 Endpoint ransomware case. |
| IPV4 | 70[.]36[.]97[.]236 | C2 address listed in the Funhouse ransomware case's Quasar RAT configuration. |
| MD5 | 17d97e3ee3185d82812a4014444c36f3 | MD5 hash listed in the article's malware indicators. |
| MD5 | 327617e977eefd15708568f43140e595 | MD5 hash listed in the article's malware indicators. |
| MD5 | 3d802ceaf891ea57ecd7d1d786d96a0d | MD5 hash listed in the article's malware indicators. |
| MD5 | 5be7578bfe633fb268ad97a520abb4e1 | MD5 hash listed in the article's malware indicators. |
| MD5 | 78c219a6bec5fc30f43b62e4934646eb | MD5 hash listed in the article's malware indicators. |
| URL | hxxp[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/adminer/logo[.]php?au=tt | Malicious payload-download URL identified in the attack chain. |
| URL | hxxp[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/enter/logo[.]php | URL listed among the article's threat indicators. |
| URL | hxxp[:]//kgbrazing[.]makeway2017[.]gethompy[.]com/skin/board/pym/logo-man[.]php | URL listed among the article's threat indicators. |
| URL | hxxp[:]//koocpt[.]site/meta/logo[.]php | URL listed among the article's threat indicators. |
| URL | hxxp[:]//masonparkpg[.]dothome[.]co[.]kr/Gorg04/a/logo-man[.]php | URL listed among the article's threat indicators. |
MITRE ATT&CK
T1027.009 · Embedded PayloadsThe initial malicious document is disguised as a resume.T1053.005 · Scheduled TaskThe article says 1.Vbs is scheduled to run.T1055 · Process InjectionThe article says 2Serges.Bmp is injected into msbuild.Exe.T1059.001 · PowerShellA PowerShell script is used in the infection chain, including UAC bypass and execution activity.T1059.003 · Windows Command ShellBatch files are used to download and launch successive stages.T1059.005 · Visual BasicVBS scripts execute files in the infection chain.T1140 · Deobfuscate/Decode Files or InformationThe document's embedded OLE data creates files in the temporary path without user interaction.T1204.002 · Malicious FileThe malicious document's payload proceeds after the user clicks its embedded hyperlink.T1547.001 · Registry Run Keys / Startup FolderThe up.Bat file is periodically updated by ch.Bat as an auxiliary means of maintaining persistence.
Threat Actors
Malware
Endpoint ransomwareThe Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as well as the overall attack chain shared numerous similarities withFunhouse ransomware AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume.Quasar RATas a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as well as the overall attack chain shared numerous similarities with Kimsuky’s endpoint ransomware
Vendors
Products
Hangul AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume.V3Additionally, they should apply the latest security patches to software—including Hangul—and operating systems, and keep V3 updated to the latest version to prevent Malware infections.