New Tactic Emerges – Kimsuky APT Hackers Exploit LNK Files to Deliver Reflective Malware, Evading Windows Defender

A sophisticated North Korean cyber-espionage campaign, attributed to the Kimsuky advanced persistent threat (APT) group, has been uncovered targeting South Korean government agencies, defense contractors, and research institutions.

The campaign showcases a blend of tailored social engineering, malicious shortcut (LNK) files, and reflective malware injection, highlighting a concerning evolution in malware delivery and stealth against standard Windows defenses.

Malicious LNK Files: The Stealthy Entry Point

Recent investigations by Aryaka Threat Research Labs revealed that Kimsuky, also known as APT43, Thallium, and Velvet Chollima, is leveraging Windows LNK files embedded in phishing emails as the initial attack vector.

These shortcuts, often distributed via ZIP archives containing seemingly legitimate South Korean government notices, entice recipients to execute the files.

Upon activation, the LNK files trigger the mshta.exe utility to fetch and execute a remote HTML Application (HTA) containing heavily obfuscated VBScript.

This script constructs URLs for further payload downloads and evades static detection by converting encoded hexadecimal values into readable instructions on the fly.

The attackers’ deception is deepened by the simultaneous download and display of decoy PDF documents, such as public safety or tax notices, enhancing the phishing attack’s credibility and urgency.

PowerShell Staging and Reflective Loading: Evading Detection

Once the victim’s device is compromised, the malware begins a multi-stage process. If Windows Defender is found inactive, the VBScript downloads additional HTA files, each concealed using similar obfuscation strategies and Base64 encoding. These stages deploy a PowerShell-based toolkit capable of:

• System profiling and credential theft.
• Keylogging via deeply embedded PowerShell scripts.
• File discovery targeting documents, crypto wallets, and credential stores.
• Sensitive browser data extraction across Chrome, Edge, and Naver Whale.

Stolen data is staged in system directories named after unique machine identifiers and compressed into segmented payloads, then exfiltrated in discreet 1MB chunks over HTTP POST requests disguised as regular web traffic.

To persist, the malware modifies the registry to relaunch itself at every user login, and implements anti-virtualization checks to evade sandbox analysis.

Notably, in a final payload stage, PowerShell scripts download and decode additional malware directly in memory using reflective DLL injection.

This technique avoids writing malicious code to disk and bypasses defenses reliant on file-based signatures or behavioral heuristics. This allows Kimsuky’s operators to run info-stealers and further backdoors undetected.

Ongoing Real-Time Control

Throughout the infection lifecycle, the malware maintains active contact with its command-and-control (C2) infrastructure. It can receive commands for file exfiltration, payload deployment, and PowerShell execution, giving attackers real-time interactive access to victim systems.

This campaign underscores the ongoing innovation among state-sponsored groups, particularly Kimsuky, in exploiting standard Windows utilities, evading endpoint protections, and focusing on information theft from strategically significant South Korean targets.

Security experts strongly recommend robust PowerShell auditing, behavioral monitoring, and the adoption of Zero Trust frameworks to counter such evolving, stealthy cyber-espionage threats.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates