Kimsuky Hackers Use LNK and JSE Lures to Target Recruiters, Crypto

The North Korea-linked Kimsuky threat group significantly broadened its targeting in the first half of 2025, launching four distinct spear-phishing campaigns. This well-known cyber espionage unit, identified by its ties to the Democratic People’s Republic of Korea (DPRK), focused its operations on corporate recruiters, cryptocurrency investors and developers, defense sector

Each campaign used a different disguise but followed the same basic playbook: trick someone into opening a file and quietly take over their computer.

What makes these attacks stand out is the variety of people they went after. Recruiters received fake resumes and business cards.

Crypto users were lured with content themed around Solana meme coins. Defense officials were sent documents tied to the K-ICTC International Scientific Combat Management Competition.

Graduate school staff were handed what appeared to be enrollment documents. In every case, the goal was identical: get a foothold without raising any flags.

Analysts at LogPresso said in a report shared with Cyber Security News that all four campaigns followed a consistent attack flow that started with displaying a decoy document while silently dropping a malicious payload, then securing persistence, and finally establishing a remote control channel.

The campaigns were distinguished mainly by their lure topics, entry methods, and command-and-control infrastructure.

The attackers showed clear signs of sophistication. Instead of using obviously suspicious servers, they routed communications through trusted platforms like GitHub raw APIs, Microsoft CDN, and VSCode tunnels.

This made their traffic blend in with normal activity, making it harder for reputation-based security tools to catch them.

Target identification was also personalized, with victims tracked through unique IDs, IP addresses, and MAC addresses.

One of the most consistent findings across all four campaigns was aggressive defense evasion from the very start.

Within five minutes of a victim opening the bait file, the malware was already disabling Windows UAC, registering Defender exceptions, and embedding itself in the Task Scheduler to survive reboots.

LogPresso noted that blocking based on individual IoCs has clear limitations, and that defenders need behavior-based detection covering the full attack chain.

Kimsuky Hackers Use LNK and JSE Lures

Three of the four campaigns relied on LNK files disguised to look like PDFs. When a victim opened one, two hidden payloads separated inside. One part quietly displayed a convincing decoy document to keep the victim unsuspecting.

The other saved a secondary LNK file to the Windows startup folder, establishing persistence before downloading and running PowerShell scripts from the attacker’s server.

The entire process completed in under five minutes, leaving very little room for human detection.

The fourth campaign took a different approach, using a JSE file with a double extension formatted as .hwpx.jse. Since Windows hides extensions by default, the victim saw what looked like a Korean HWP document.

Once opened, the script decoded a hidden DLL using the built-in certutil tool and loaded it using rundll32.exe, a legitimate Windows component.

This campaign went further by using a VSCode tunnel to maintain persistent remote access, riding on Microsoft’s own signed binaries to stay undetected.

Abuse of Legitimate Services for C2

A thread that ran through every campaign was Kimsuky’s heavy use of legitimate services for command-and-control operations. GitHub repositories stored payloads and collected victim data.

Microsoft CDN helped deliver files without triggering network alerts. VSCode tunnels created persistent remote access through GitHub OAuth authentication.

In one case, a private server at nelark.icu acted as the C2, while another campaign funneled data through the Korean site yespp.co.kr.

LogPresso’s analysis makes clear that defenders cannot rely on blocking domains or file hashes alone.

Since Kimsuky rotates its infrastructure quickly, organizations should watch for LNK or JSE files with double extensions, monitor unexpected Task Scheduler entries disguised as OneDrive or Intel services, and flag any instance of UAC being disabled outside normal administrative activity.

Building detection around behaviors rather than static indicators is the only reliable way to stay ahead of a group this adaptive.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.