Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger Kill Chain Recovered from Live C2 (api_reference.chm, check.nid-log.com)

Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger (TL-2026-0461), also tracked as api_reference.chm campaign, is a high-severity malware campaign, first published 2026-05-05. It is attributed to Kimsuky (North Korea) with high confidence, affects Microsoft Windows, maps to 25 MITRE ATT&CK techniques (T1027, T1033, T1041), and is covered by 9 detection rules and 59 indicators of compromise.

Key facts for TL-2026-0461

Threat ID
TL-2026-0461
Also known as
api_reference.chm campaign, Kimsuky Million OK 2026, check.nid-log.com kill chain
Severity
HIGH
Status
MONITORING
Category
MALWARE
First published
2026-05-05
Last reviewed
2026-05-05
Attribution
Kimsuky
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
ESPIONAGE
Target sectors
government, defense, academia, think-tanks, ngo, media, small-business, financial
Target regions
South Korea, East Asia
Detection rules
9
Indicators of compromise
59

Malware and tooling in Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger

Malware and tooling: BitJoker, Kimsuky CHM Dropper, Million OK !!!!

On April 11, 2026, researchers analyzed a Compiled HTML Help (CHM) file (api_reference.chm) attributed to the DPRK-aligned Kimsuky group that initiated a three-stage attack chain. A misconfigured C2 server at check.nid-log.com had directory listing enabled, which allowed full source-code recovery of every payload stage: a 6,338-byte VBScript performing system reconnaissance and establishing persistence via a scheduled task, a 449-byte VBScript bridge that launches a PowerShell child process, and a 6,234-byte PowerShell keylogger with clipboard monitoring and timed HTTP exfiltration. Infrastructure spans 79+ domains across at least 5 C2 IPs hosted on Korean VPS providers (notably DAOU Technology subnets) and dynamic-DNS providers. The C2 returns the legacy Kimsuky 'Million OK !!!!' signature on an upgraded Apache/PHP stack. Targeting focuses on Korean Naver users via credential phishing and South Korean tax authority impersonation.

How Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger works

## Overview

This threat documents a complete, source-recovered attack chain operated by the Kimsuky group (also tracked as APT43, Velvet Chollima, Black Banshee, Thallium), a North Korean state-sponsored cluster reporting to the Reconnaissance General Bureau. Researchers at OffSeq Threat Radar (April 11, 2026) and the malware.news Korean security community (April 13, 2026) independently analyzed a Compiled HTML Help file named 'api_reference.chm' (1,048,576 bytes; MD5 0ac44ad9cfbc58ed76415f7bc79239f9). The CHM was delivered as a phishing lure masquerading as legitimate API reference documentation. A directory-listing misconfiguration on the operator-controlled C2 server check.nid-log.com exposed the full server-side payload tree, allowing recovery of source code for all three execution stages plus the PHP backend handlers (bootservice.php, checkservice.php, finalservice.php).

## Stage 1 — CHM Container (api_reference.chm)

The CHM container abuses Microsoft's hh.exe / itss.dll execution surface (T1218.001 — System Binary Proxy Execution: Compiled HTML File). When opened, an embedded HTML/JavaScript object launches an out-of-process VBScript via the WScript.Shell/ActiveX bridge typical of Kimsuky CHM lures. Execution drops Stage 1 to disk and invokes wscript.exe to run it.

## Stage 2 — VBScript Reconnaissance and Persistence (6,338 bytes)

The first VBScript performs: - Host enumeration via WMI (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Process) - Username, hostname, domain, build number, antivirus product collection - Outbound HTTP POST of recon results to http://check.nid-log.com/api/bootservice.php?tag=<system_id> - Persistence creation via schtasks.exe registering a recurring task that re-launches the bridge VBScript at logon (T1053.005) - Polling of http://check.nid-log.com/api/checkservice.php for command-line directives and additional payload URLs

## Stage 3 — VBScript-to-PowerShell Bridge (449 bytes)

A minimal bridge VBScript fetches the encoded PowerShell keylogger body from a checkservice.php endpoint, decodes it, and spawns powershell.exe -nop -w hidden -ep bypass -enc <BASE64>. The bridge exists to defeat naive AV that signature on the larger PowerShell body and to provide a clean handoff that the scheduled task can repeatedly invoke.

## Stage 4 — PowerShell Keylogger with Clipboard Monitor (6,234 bytes)

The terminal payload uses Windows API access through Add-Type / P/Invoke to: - Hook keystrokes via GetAsyncKeyState in a polling loop (T1056.001) - Capture clipboard content periodically via System.Windows.Forms.Clipboard::GetText (T1115) - Buffer captured data in memory with a sliding rotation - POST the captured buffer to http://check.nid-log.com/api/finalservice.php on a 30-minute timer (configurable) - Distinguish Korean keyboard layouts (Hangul / IME composition) using the keyboard layout API to capture Korean text properly

## Infrastructure and Attribution

Researchers pivoted from check.nid-log.com to map at least 79 sibling Kimsuky domains across the verified C2 IP set (51.79.185.184, 118.194.249.109, 130.94.29.111, 162.255.119.150, 27.102.137.150, 27.102.137.38, 27.102.138.45, 38.60.220.135). The 27.102.0.0/16 space resolves to DAOU Technology (Korean hosting) subnets that have been associated with Kimsuky operations since at least 2022. Domain themes are heavily Naver- and Korean-tax-impersonating: nid-log.com (Naver ID Login pun), nid-htl.duckdns.org, nid-navercwu.servecounterstrike.com, miss-tax.dns.navy, pay-tax.dns.navy, tax-invoice.dns.army, verify.efine-log.kro.kr (efine.go.kr is the Korean tax fines portal). The C2 web stack returns the literal string 'Million OK !!!!' to baseline GET requests — a long-running Kimsuky tell first documented in 2014 and consistently observed across 'BabyShark', 'AppleSeed', and 'BlueLight' clusters. The current campaign upgrades the C2 from older PHP 5.x / nginx to a modern Apache + PHP stack but retains the signature.

## Targeting and Impact

The campaign aligns with Kimsuky's standard victim profile: South Korean policy researchers, defectors, journalists, defense and unification think-tank staff, and academic cohorts working on DPRK topics. Tax-impersonation lures cast a wider net at Korean SMBs to harvest Naver and corporate credentials for follow-on targeted intrusions. With the keylogger plus clipboard-capture combination, recovered tokens, MFA codes, and 2FA seeds are sufficient to enable account-takeover of Naver Mail, Naver Cafe, NaverWorks, and KakaoTalk Web sessions during the timed exfiltration windows. Loss of these accounts then enables further internal phishing within Korean academic and policy networks.

## Why This Matters for Defenders

Full source-code recovery is rare for Kimsuky operations and provides high-fidelity behavioral anchors: the exact PowerShell command line, the exact schtasks pattern, the exact HTTP path structure (/api/bootservice.php?tag=, /api/checkservice.php, /api/finalservice.php), and the 'Million OK !!!!' HTTP body signature. These produce extremely low-FP detection content for Sysmon, EDR, and proxy logs. Korean-language defenders should additionally tune for Naver-impersonating dynamic-DNS labels (nid-naver*) and tax-impersonating labels (*-tax.dns.navy, tax-invoice.dns.*).

MITRE ATT&CK techniques used in TL-2026-0461

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution

Discovery

T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Software Discovery: Security Software Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

Credential Access

T1056.001 Input Capture: Keylogging

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1568.001 Dynamic Resolution: Fast Flux DNS

Collection

T1115 Clipboard Data

stealth

T1218.001 System Binary Proxy Execution: Compiled HTML File

Initial Access

T1566 Phishing; T1566.001 Spearphishing Attachment

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.003 Acquire Infrastructure: Virtual Private Server; T1587.001 Develop Capabilities: Malware

Affected products and versions in Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger

  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022
  • Naver Corporation — Naver Account / Naver Mail (impersonation target)
    Vulnerable versions: all

Remediation for Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger

Patches

  • Microsoft has not issued a CHM-specific patch; mitigation is via configuration. Apply the latest cumulative update to ensure ASR rules are available.

Immediate actions

  • Block all 16 verified domains and 8 C2 IPs at perimeter, web proxy, and DNS resolvers
  • Block the URL paths /api/bootservice.php, /api/checkservice.php, /api/finalservice.php at the proxy regardless of host
  • Hunt for HTTP responses containing the literal body 'Million OK !!!!' across proxy logs (90 day lookback)
  • Hunt for Compiled HTML Help (.chm) files received via email or downloaded from web in the last 60 days; quarantine and triage
  • Hunt for scheduled tasks created by wscript.exe or hh.exe child processes
  • Hunt for powershell.exe -enc launched by wscript.exe or by a scheduled task whose action is wscript.exe

Workarounds

  • Block .chm at email gateway as a high-risk attachment type
  • Strip or sandbox CHM downloads at web proxy
  • Use Windows Defender Application Control (WDAC) to deny hh.exe execution outside of administrative contexts

Longer-term hardening

  • Disable hh.exe and CHM file association for non-administrator users via GPO / AppLocker
  • Set default open handler for .chm to a sandboxed reader or block via Attack Surface Reduction (ASR) rule 'Block Win32 API calls from Office macros' and ASR 'Block executable content from email client and webmail'
  • Deploy AMSI-enforced PowerShell logging (Module + Script Block) and ship to SIEM with retention >= 90 days
  • Enable Sysmon with SwiftOnSecurity / Olaf Hartong config focused on EventID 1, 7, 11, 13, 22 for keylogger/clipboard heuristics
  • Subscribe to Korean CERT (KrCERT/CC) advisories for Kimsuky infrastructure feeds
  • Implement DMARC enforcement and Naver-impersonation header inspection at mail gateway

Weaknesses (CWE) in Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger

CWE-548, CWE-345, CWE-94

Timeline of Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger

  • Kaspersky publishes original Kimsuky write-up identifying the actor and the 'Million OK !!!!' C2 signature that this campaign still uses.
  • CISA, FBI and US Cyber Command publish AA20-301A focusing on Kimsuky TTPs.
  • Mandiant graduates Kimsuky-overlap cluster to APT43 designation, formalizing nation-state attribution.
  • Domain set including check.nid-log.com is observed live with API endpoints serving payloads.
  • Researchers identify directory listing exposure on check.nid-log.com C2 server, enabling source-code recovery.
  • OffSeq Threat Radar publishes 'Live C2 Dump Recovering Every Stage of the Kill Chain' with full IOC set and stage-by-stage analysis.
  • Korean security community on malware.news publishes complementary analysis of api_reference.chm tying the chain to Kimsuky and the 'Million OK !!!!' signature.
  • Infrastructure pivot expands cluster to 79+ Kimsuky-aligned domains across the 5 verified C2 IPs.
  • Threadlinqs Intelligence publishes TL-2026-0461 with full MITRE mapping, 9 detection rules, and idempotent simulation set.
  • As of 2026-05-29, Kimsuky/APT43 remains highly active against South Korea, with new CHM/LOLBin tooling (HTTPSpy, HelloDoor, VS Code tunnels) reported through late May 2026. The specific check.nid-log.com C2 was burned via directory-listing exposure in April and its IPs/domains rotate, but the actor and the documented CHM-keylogger TTPs persist as a live threat.

Sources cited for Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger

Threats related to Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger

Detection coverage for TL-2026-0461

As of 2026-05-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0461 across Splunk SPL, Microsoft KQL and Sigma, covering 59 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats