Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger Kill Chain Recovered from Live C2 (api_reference.chm, check.nid-log.com) — Threadlinqs Intelligence
As of 2026-05-30, Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger Kill Chain Recovered from Live C2 (api_reference.chm, check.nid-log.com) is a high-severity malware threat attributed to Kimsuky (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 59 indicators of compromise.
Threat ID: TL-2026-0461 · Severity: HIGH · Status: MONITORING · Category: MALWARE
Attribution: Kimsuky · North Korea · ESPIONAGE
On April 11, 2026, researchers analyzed a Compiled HTML Help (CHM) file (api_reference.chm) attributed to the DPRK-aligned Kimsuky group that initiated a three-stage attack chain. A misconfigured C2
## Overview
This threat documents a complete, source-recovered attack chain operated by the Kimsuky group (also tracked as APT43, Velvet Chollima, Black Banshee, Thallium), a North Korean state-sponsored cluster reporting to the Reconnaissance General Bureau. Researchers at OffSeq Threat Radar (April 11, 2026) and the malware.news Korean security community (April 13, 2026) independently analyzed a Compiled HTML Help file named 'api_reference.chm' (1,048,576 bytes; MD5 0ac44ad9cfbc58ed76415f7bc79239f9). The CHM was delivered as a phishing lure masquerading as legitimate API reference documentation. A directory-listing misconfiguration on the operator-controlled C2 server check.nid-log.com exposed the full server-side payload tree, allowing recovery of source code for all three execution stages plus the PHP backend handlers (bootservice.php, checkservice.php, finalservice.php).
## Stage 1 — CHM Container (api_reference.chm)
The CHM container abuses Microsoft's hh.exe / itss.dll execution surface (T1218.001 — System Binary Proxy Execution: Compiled HTML File). When opened, an embedded HTML/JavaScript object launches an out-of-process VBScript via the WScript.Shell/ActiveX bridge typical of Kimsuky CHM lures. Execution drops Stage 1 to disk and invokes wscript.exe to run it.
## Stage 2 — VBScript Reconnaissance and Persistence (6,338 bytes)
The first VBScript performs:
- Host enumeration via WMI (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Process)
- Username, hostname, domain, build number, antivirus product collection
- Outbound HTTP POST of recon results to http://check.nid-log.com/api/bootservice.php?tag=<system_id>
- Persistence creation via schtasks.exe registering a recurring task that re-launches the bridge VBScript at logon (T1053.005)
- Polling of http://check.nid-log.com/api/checkservice.php for command-line directives and additional payload URLs
## Stage 3 — VBScript-to-PowerShell Bridge (449 bytes)
A minimal bridge VBScript fetches the encoded PowerShell keylogger body from a checkservice.php endpoint, decodes it, and spawns powershell.exe -nop -w hidden -ep bypass -enc <BASE64>. The bridge exists to defeat naive AV that signature on the larger PowerShell body and to provide a clean handoff that the scheduled task can repeatedly invoke.
## Stage 4 — PowerShell Keylogger with Clipboard Monitor (6,234 bytes)
The terminal payload uses Windows API access through Add-Type / P/Invoke to:
- Hook keystrokes via GetAsyncKeyState in a polling loop (T1056.001)
- Capture clipboard content periodically via System.Windows.Forms.Clipboard::GetText (T1115)
- Buffer captured data in memory with a sliding rotation
- POST the captured buffer to http://check.nid-log.com/api/finalservice.php on a 30-minute timer (configurable)
- Distinguish Korean keyboard layouts (Hangul / IME composition) using the keyboard layout API to capture Korean text properly
## Infrastructure and Attribution
Researchers pivoted from check.nid-log.com to map at least 79 sibling Kimsuky domains across the verified C2 IP set (51.79.185.184, 118.194.249.109, 130.94.29.111, 162.255.119.150, 27.102.137.150, 27.102.137.38, 27.102.138.45, 38.60.220.135). The 27.102.0.0/16 space resolves to DAOU Technology (Korean hosting) subnets that have been associated with Kimsuky operations since at least 2022. Domain themes are heavily Naver- and Korean-tax-impersonating: nid-log.com (Naver ID Login pun), nid-htl.duckdns.org, nid-navercwu.servecounterstrike.com, miss-tax.dns.navy, pay-tax.dns.navy, tax-invoice.dns.army, verify.efine-log.kro.kr (efine.go.kr is the Korean tax fines portal). The C2 web stack returns the literal string 'Million OK !!!!' to baseline GET requests — a long-running Kimsuky tell first documented in 2014 and consistently observed across 'BabyShark', 'AppleSeed', and 'BlueLight' clusters. The current campaign upgrades the C2 from older PHP 5.x / nginx to a modern Apache + PHP stack but retains the signature.
## Targeting and Impact
The ca
Weaknesses (CWE)
CWE-548, CWE-345, CWE-94
Target sectors: government, defense, academia, think-tanks, ngo, media, small-business, financial
Target regions: South Korea, East Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 59 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.001, T1059.001, T1059.005, T1204.002, T1218.001, T1053.005, T1140, T1027, T1070.004