# Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger Kill Chain Recovered from Live C2 (api_reference.chm, check.nid-log.com)

> On April 11, 2026, researchers analyzed a Compiled HTML Help (CHM) file (api_reference.chm) attributed to the DPRK-aligned Kimsuky group that initiated a three-stage attack chain. A misconfigured C2 server at check.nid-log.com had directory listing enabled, which allowed full source-code recovery of every payload stage: a 6,338-byte VBScript performing system reconnaissance and establishing persistence via a scheduled task, a 449-byte VBScript bridge that launches a PowerShell child process, and a 6,234-byte PowerShell keylogger with clipboard monitoring and timed HTTP exfiltration. Infrastructure spans 79+ domains across at least 5 C2 IPs hosted on Korean VPS providers (notably DAOU Technology subnets) and dynamic-DNS providers. The C2 returns the legacy Kimsuky 'Million OK !!!!' signature on an upgraded Apache/PHP stack. Targeting focuses on Korean Naver users via credential phishing and South Korean tax authority impersonation.

- **Published:** 2026-05-05T12:00:00Z
- **Last reviewed:** 2026-05-05T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0461
- **ID:** TL-2026-0461
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 59 (full data via the Threadlinqs MCP server — Purple tier)

## Description

## Overview

This threat documents a complete, source-recovered attack chain operated by the Kimsuky group (also tracked as APT43, Velvet Chollima, Black Banshee, Thallium), a North Korean state-sponsored cluster reporting to the Reconnaissance General Bureau. Researchers at OffSeq Threat Radar (April 11, 2026) and the malware.news Korean security community (April 13, 2026) independently analyzed a Compiled HTML Help file named 'api_reference.chm' (1,048,576 bytes; MD5 0ac44ad9cfbc58ed76415f7bc79239f9). The CHM was delivered as a phishing lure masquerading as legitimate API reference documentation. A directory-listing misconfiguration on the operator-controlled C2 server check.nid-log.com exposed the full server-side payload tree, allowing recovery of source code for all three execution stages plus the PHP backend handlers (bootservice.php, checkservice.php, finalservice.php).

## Stage 1 — CHM Container (api_reference.chm)

The CHM container abuses Microsoft's hh.exe / itss.dll execution surface (T1218.001 — System Binary Proxy Execution: Compiled HTML File). When opened, an embedded HTML/JavaScript object launches an out-of-process VBScript via the WScript.Shell/ActiveX bridge typical of Kimsuky CHM lures. Execution drops Stage 1 to disk and invokes wscript.exe to run it.

## Stage 2 — VBScript Reconnaissance and Persistence (6,338 bytes)

The first VBScript performs:
- Host enumeration via WMI (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Process)
- Username, hostname, domain, build number, antivirus product collection
- Outbound HTTP POST of recon results to http://check.nid-log.com/api/bootservice.php?tag=<system_id>
- Persistence creation via schtasks.exe registering a recurring task that re-launches the bridge VBScript at logon (T1053.005)
- Polling of http://check.nid-log.com/api/checkservice.php for command-line directives and additional payload URLs

## Stage 3 — VBScript-to-PowerShell Bridge (449 bytes)

A minimal bridge VBScript fetches the encoded PowerShell keylogger body from a checkservice.php endpoint, decodes it, and spawns powershell.exe -nop -w hidden -ep bypass -enc <BASE64>. The bridge exists to defeat naive AV that signature on the larger PowerShell body and to provide a clean handoff that the scheduled task can repeatedly invoke.

## Stage 4 — PowerShell Keylogger with Clipboard Monitor (6,234 bytes)

The terminal payload uses Windows API access through Add-Type / P/Invoke to:
- Hook keystrokes via GetAsyncKeyState in a polling loop (T1056.001)
- Capture clipboard content periodically via System.Windows.Forms.Clipboard::GetText (T1115)
- Buffer captured data in memory with a sliding rotation
- POST the captured buffer to http://check.nid-log.com/api/finalservice.php on a 30-minute timer (configurable)
- Distinguish Korean keyboard layouts (Hangul / IME composition) using the keyboard layout API to capture Korean text properly

## Infrastructure and Attribution

Researchers pivoted from check.nid-log.com to map at least 79 sibling Kimsuky domains across the verified C2 IP set (51.79.185.184, 118.194.249.109, 130.94.29.111, 162.255.119.150, 27.102.137.150, 27.102.137.38, 27.102.138.45, 38.60.220.135). The 27.102.0.0/16 space resolves to DAOU Technology (Korean hosting) subnets that have been associated with Kimsuky operations since at least 2022. Domain themes are heavily Naver- and Korean-tax-impersonating: nid-log.com (Naver ID Login pun), nid-htl.duckdns.org, nid-navercwu.servecounterstrike.com, miss-tax.dns.navy, pay-tax.dns.navy, tax-invoice.dns.army, verify.efine-log.kro.kr (efine.go.kr is the Korean tax fines portal). The C2 web stack returns the literal string 'Million OK !!!!' to baseline GET requests — a long-running Kimsuky tell first documented in 2014 and consistently observed across 'BabyShark', 'AppleSeed', and 'BlueLight' clusters. The current campaign upgrades the C2 from older PHP 5.x / nginx to a modern Apache + PHP stack but retains the signature.

## Targeting and Impact

The campaign aligns with Kimsuky's standard victim profile: South Korean policy researchers, defectors, journalists, defense and unification think-tank staff, and academic cohorts working on DPRK topics. Tax-impersonation lures cast a wider net at Korean SMBs to harvest Naver and corporate credentials for follow-on targeted intrusions. With the keylogger plus clipboard-capture combination, recovered tokens, MFA codes, and 2FA seeds are sufficient to enable account-takeover of Naver Mail, Naver Cafe, NaverWorks, and KakaoTalk Web sessions during the timed exfiltration windows. Loss of these accounts then enables further internal phishing within Korean academic and policy networks.

## Why This Matters for Defenders

Full source-code recovery is rare for Kimsuky operations and provides high-fidelity behavioral anchors: the exact PowerShell command line, the exact schtasks pattern, the exact HTTP path structure (/api/bootservice.php?tag=, /api/checkservice.php, /api/finalservice.php), and the 'Million OK !!!!' HTTP body signature. These produce extremely low-FP detection content for Sysmon, EDR, and proxy logs. Korean-language defenders should additionally tune for Naver-impersonating dynamic-DNS labels (nid-naver*) and tax-impersonating labels (*-tax.dns.navy, tax-invoice.dns.*).

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1204.002 User Execution: Malicious File
- T1218.001 System Binary Proxy Execution: Compiled HTML File
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1218 System Binary Proxy Execution
- T1056.001 Input Capture: Keylogging
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1033 System Owner/User Discovery
- T1115 Clipboard Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1568.001 Dynamic Resolution: Fast Flux DNS
- T1041 Exfiltration Over C2 Channel
- T1583.001 Acquire Infrastructure: Domains
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1587.001 Develop Capabilities: Malware

## Sources

- [Live C2 Dump Recovering Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger](https://radar.offseq.com/threat/live-c2-dump-recovering-every-stage-of-the-kill-ch-709bdb72)
- [API Reference 관련 위장한 김수키(Kimsuky)에서 만든 악성코드 - api_reference.chm](https://malware.news/t/api-reference-kimsuky-api-reference-chm/105978)
- [MITRE ATT&CK — Kimsuky (G0094)](https://attack.mitre.org/groups/G0094/)
- [MITRE ATT&CK — T1218.001 Compiled HTML File](https://attack.mitre.org/techniques/T1218/001/)
- [MITRE ATT&CK — T1056.001 Keylogging](https://attack.mitre.org/techniques/T1056/001/)
- [MITRE ATT&CK — T1115 Clipboard Data](https://attack.mitre.org/techniques/T1115/)
- [Mandiant — Assessed Cyber Structure and Alignments of North Korea (APT43)](https://www.mandiant.com/resources/reports/apt43-north-korea-cybercrime-espionage)
- [CISA Alert AA20-301A — North Korean Advanced Persistent Threat Focus: Kimsuky](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0461