Kimsuky Hackers Deploy Funhouse Ransomware via Malicious Resume Docs

Key Takeaways

• The Kimsuky APT group is deploying Funhouse ransomware using weaponized Hangul Word Processor (HWP) documents disguised as resumes.
• The attack chain involves a multi-stage process, including embedded OLE data, VBScript execution, Python-based backdoors, and Quasar RAT for ransomware deployment.
• This campaign represents an evolution in Kimsuky’s initial access methods, shifting from LNK files to HWP documents, but maintains consistent tooling and ransomware characteristics with previous Endpoint ransomware attacks.
• The Funhouse ransomware is a variant of the earlier Endpoint ransomware, sharing significant code and operational similarities.
• Organizations, particularly those in recruitment or human resources, should exercise extreme caution with unsolicited resume documents and implement robust endpoint security measures.

Kimsuky Shifts Tactics to Deploy Funhouse Ransomware via Malicious Resumes

The notorious Kimsuky advanced persistent threat (APT) group has been observed utilizing a deceptive tactic involving malicious resume documents to distribute Funhouse ransomware. This sophisticated attack leverages a sequence of scripts and remote access tools, culminating in file encryption.

Initial Compromise Through Deceptive Document

The cyberattack initiates with a Hangul Word Processor (HWP) document, craftily presented as a job application. This seemingly innocuous file serves as the initial vector for a multi-stage malware infection process. According to Researchers from AhnLab Security intelligence Center (ASEC) identified this Funhouse malware delivery case in a report released on October 1, 2026.

The malicious HWP file, often named `resume.Hwp`, contains embedded Object Linking and Embedding (OLE) data. Upon opening the document, the Hangul process automatically extracts two files, `pdf.Exe` and `pdf.Exe.Manifest`, into the Windows temporary directory without requiring any further user interaction. The `pdf.Exe` file is a VbsEdit script executor, while `pdf.Exe.Manifest` holds the malicious script for the subsequent stage.

A critical step in the attack chain is a hyperlink embedded within the resume document, inviting the recipient to open a PDF file with a person’s name, such as `resume_{name}.Pdf`. While the initial document drop occurs simply by opening the HWP file, clicking this internal link is what triggers the next phase of the attack, leading to remote access and the eventual execution of the ransomware. This method highlights a strategic distinction: the document itself is bait, but the embedded link is the actual trigger for the malicious payload. This approach mirrors previous Kimsuky operations where weaponized HWP documents used embedded files and clickable links to initiate malicious activity.

Multi-Stage Infection Chain and Tooling

The Funhouse campaign is not a simple direct ransomware drop. ASEC’s analysis reveals a complex, multi-stage infection process that progresses from the initial HWP document through several scripting layers before deploying the ransomware. The stages include the execution of batch, VBS, and PowerShell scripts, followed by the installation of a Python-based backdoor. This backdoor then facilitates the deployment of Quasar RAT, which is ultimately used to deliver and execute the Funhouse ransomware. The use of a Python stage aligns with Kimsuky’s historical operations, including a past campaign that used malicious LNK files disguised as documents to install a Python backdoor via multiple scripts.

ASEC also noted similarities in the batch code used in the Funhouse case to earlier Kimsuky samples. The group frequently updates this batch component, which serves as a persistent mechanism for maintaining access to compromised systems.

Quasar RAT and Ransomware Evolution

Quasar RAT plays a pivotal role in connecting this recent Funhouse campaign to Kimsuky’s previous activities. The Quasar RAT sample found in the Funhouse attack utilizes a configuration file with a `.dwg` extension, containing vital information such as the command-and-control (C2) address, target identifier, and a mutex name. The latest configuration observed reports version 4.4.3 of Quasar RAT, a notable upgrade from version 1.1.8 used in earlier related cases.

Despite changes in configuration filenames, server addresses, and target specifics, the Quasar mutex `_QQ_XCZ_VCXZ` remained consistent across the February, June, and September instances analyzed by ASEC. This consistency strongly supports ASEC’s conclusion regarding the continuity of Kimsuky’s operations and underscores the importance for investigators to analyze consistent behavioral patterns and configurations rather than solely focusing on superficial changes like filenames or server IPs.

ASEC identified Funhouse as a direct variant of the Endpoint ransomware. Both the June Endpoint and September Funhouse samples share identical encryption extensions (`.Funhouse`), ransom-note filenames (`How To Restore Your Files.Txt`), mutexes (`DoYouWantToHaveSexWithCuongDong`), encryption methods (HC-128), key-generation approaches (CryptGenRandom, Curve25519, and SHA-512), footer sizes (72 bytes), and footer markers (`Choung Dong looks like a hot dog!!`). While the attacker’s contact email address changed between the samples, the core file-encryption characteristics remained consistent. This contrasts with an earlier February Endpoint sample, which used ChaCha20 encryption and a different key-generation method, highlighting an evolution within the ransomware family itself.

The shift in initial delivery from previously favored LNK files to HWP documents is likely a tactic to reduce suspicion. A resume is a common business document, particularly for personnel involved in recruitment. Kimsuky has a history of employing recruiter-themed phishing campaigns, using fake resumes and business cards to tailor their lures to fit a recipient’s typical professional tasks.

What You Should Do

• Be Vigilant with Attachments: Exercise extreme caution when opening unsolicited resume documents, especially those in HWP format. Verify the sender’s legitimacy.
• Inspect Embedded Links: Do not click on links within documents from unknown or untrusted sources. Hover over links to preview their destination before clicking.
• Maintain Software Updates: Ensure that Hangul Word Processor (HWP), operating systems, and all other software are regularly updated to patch known vulnerabilities.
• Implement Robust Endpoint Protection: Deploy and maintain advanced endpoint detection and response (EDR) solutions and antivirus software to detect and block malicious scripts and ransomware.
• Monitor for Suspicious Activity: Look for unusual script execution, unexpected file creation in temporary folders, and outbound connections from HWP processes or related executables.
• Educate Employees: Conduct regular cybersecurity awareness training for all staff, particularly those in HR or administrative roles, on identifying phishing attempts and malicious documents.
• Backup Data: Regularly back up critical data to isolated, secure locations to minimize the impact of a ransomware attack.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.